\u00cen gestionele de pachete Nix \u0219i Lix a fost descoperit\u0103 o vulnerabilitate care permite executarea de cod cu privilegiile procesului de fundal, care \u00een NixOS \u0219i \u00een instal\u0103rile multi-utilizator este rulat de utilizatorul root. Problema (CVE neatribuit) se manifest\u0103 \u00een procesul de fundal nix-daemon, utilizat pentru a organiza accesul utilizatorilor nepriviligia\u021bi la opera\u021biile de compilare \u0219i magazinul de pachete. <\/p>\n
Vulnerabilitatea apare din cauza lipsei unei limite \u00een procesarea recursiv\u0103 a directorilor \u00een codul pentru analiza arhivelor NAR (Nix Archive), ceea ce poate fi folosit pentru a ini\u021bia epuizarea stivei de corutine \u0219i rescrierea con\u021binutului heap-ului plasat dup\u0103 stiv\u0103 f\u0103r\u0103 pagini de protec\u021bie a memoriei. Problema poate fi exploatat\u0103 de orice utilizator capabil s\u0103 stabileasc\u0103 conexiuni cu nix-daemon. Implicit, to\u021bi utilizatorii au aceast\u0103 capacitate, ceea ce permite cre\u0219terea privilegiilor p\u00e2n\u0103 la utilizatorul root \u00een instal\u0103rile multi-utilizator Nix. <\/p>\n
Problema a fost rezolvat\u0103 prin limitarea nivelului de recursiune la 64 de directoare imbricate, ad\u0103ugarea de pagini de protec\u021bie a memoriei \u00eentre stiv\u0103 \u0219i heap \u0219i implementarea de verific\u0103ri suplimentare pentru linkurile simbolice \u00een NAR. \u00cen Nix, vulnerabilitatea se manifest\u0103 \u00eencep\u00e2nd cu versiunea 2.24.4 \u0219i a fost remediat\u0103 \u00een versiunile 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, 2.28.7. \u00cen Lix, vulnerabilitatea a ap\u0103rut \u00een versiunea 2.93.0 \u0219i a fost corectat\u0103 \u00een actualiz\u0103rile 2.93.4, 2.94.2 \u0219i 2.95.2. Managerul de pachete Guix nu este afectat de aceast\u0103 vulnerabilitate. <\/p>\n
\u00cen plus, \u00een actualiz\u0103rile publicate, Nix a remediat o alt\u0103 vulnerabilitate (f\u0103r\u0103 CVE), care a fost clasificat\u0103 cu un nivel mediu de severitate (4.3 din 10). Problema apare \u00eencep\u00e2nd cu versiunea Nix 2.24.7 \u0219i permite scrierea fi\u0219ierelor \u00een zona din afara directorului r\u0103d\u0103cin\u0103 \u00een care se desf\u0103\u0219oar\u0103 decomprimarea arhivei. Vulnerabilitatea este exploatat\u0103 prin crearea, \u00een fi\u0219ierele tar, a elementelor cu c\u0103i de fi\u0219ier absolute. Atunci c\u00e2nd astfel de arhive sunt decomprimate cu comanda «nix-prefetch-url —unpack» sau «nix store prefetch-file —unpack», fi\u0219ierele cu c\u0103i absolute sunt extrase ca atare, f\u0103r\u0103 a fi transformate \u00eentr-o cale relativ\u0103. \u0412 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0445 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430\u0445 Nix \u0438 Lix \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0444\u043e\u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 NixOS \u0438 \u043c\u043d\u043e\u0433\u043e\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c root. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 (CVE \u043d\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d) \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0444\u043e\u043d\u043e\u0432\u043e\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 nix-daemon, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043a \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u043c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f\u043c \u0438 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0438\u0437-\u0437\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0440\u0435\u043a\u0443\u0440\u0441\u0438\u0432\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0439 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170428","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi \u00een Nix \u0219i Lix care permit cre\u0219terea privilegiilor \u00een sistem | ProHoster","description":"\u00cen managerii de pachete Nix \u0219i Lix a fost descoperit\u0103 o vulnerabilitate care permite executarea codului cu privilegii de proces de fundal, care \u00een NixOS \u0219i \u00een instal\u0103rile multi-utilizator este rulat sub utilizatorul root.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-nix-i-lix-pozvolyayushhie-podnyat-privilegii-v-sisteme","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Nix \u0438 Lix, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0445 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430\u0445 Nix \u0438 Lix \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0444\u043e\u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 NixOS \u0438 \u043c\u043d\u043e\u0433\u043e\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c root.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-nix-i-lix-pozvolyayushhie-podnyat-privilegii-v-sisteme","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-05T16:24:32+00:00","article:modified_time":"2026-05-05T16:24:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/170428","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=170428"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/170428\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=170428"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=170428"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=170428"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"