Vulnerabilities in Nix and Lix that allow privilege escalation in the system
A vulnerability has been identified in the Nix and Lix package managers that allows code execution with the rights of a background process, which in NixOS and multi-user installations runs under the root user. The issue (CVE not assigned) manifests in the nix-daemon background process used to facilitate access for unprivileged users to build operations and the package repository. The vulnerability arises from the lack of limitation on the recursive processing of directories in […]
