{"id":170428,"date":"2026-05-05T18:24:32","date_gmt":"2026-05-05T16:24:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-nix-i-lix-pozvolyayushhie-podnyat-privilegii-v-sisteme"},"modified":"2026-05-05T18:24:32","modified_gmt":"2026-05-05T16:24:32","slug":"uyazvimosti-v-nix-i-lix-pozvolyayushhie-podnyat-privilegii-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-nix-i-lix-pozvolyayushhie-podnyat-privilegii-v-sisteme","title":{"rendered":"Vulnerabilities in Nix and Lix that allow privilege escalation in the system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been identified in the Nix and Lix package managers that allows code execution with the privileges of the background process, which in NixOS and multi-user installations runs as the root user. The issue (CVE not assigned) manifests in the background process nix-daemon, used to provide access for unprivileged users to build operations and the package repository. <\/p>\n
The vulnerability arises from a lack of restriction on recursive directory processing in the code for parsing NAR (Nix Archive) files, which can be exploited to trigger stack exhaustion of coroutines and overwrite heap memory content placed after the stack without guard pages. The issue can be exploited by any user able to connect to the nix-daemon. By default, all users have this capability, allowing them to escalate their privileges to root in multi-user Nix installations. <\/p>\n
The problem has been resolved by limiting the recursion depth to 64 nested directories, adding guard pages between the stack and heap, and implementing additional checks for symbolic links in NAR. In Nix, the vulnerability appears starting with version 2.24.4 and has been fixed in releases 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, 2.28.7. In Lix, the vulnerability was introduced in release 2.93.0 and has been fixed in updates 2.93.4, 2.94.2, and 2.95.2. The Guix package manager is not affected by this vulnerability. <\/p>\n
In addition, the published updates for Nix have addressed another vulnerability (CVE not provided) which has been assigned a medium severity level (4.3 out of 10). The issue appears starting from the release of Nix 2.24.7 and allows for writing files in an area outside the root directory where the archive is extracted. The vulnerability is exploited by creating elements with absolute file paths in tar files. When extracting such archives using the command «nix-prefetch-url —unpack» or «nix store prefetch-file —unpack», files with absolute paths are extracted as is, without being converted to a relative path. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"