Nix असुरक्षित NAR अनपैकिंग से प्रभावित

The impact of CVE-2024-45593 is severe. A successful exploit allows an attacker to write arbitrary files to the system with root privileges. This could lead to complete system compromise, including the installation of malware, modification of critical system files, and persistent backdoor access. The ability to write to arbitrary locations significantly expands the attack surface, potentially affecting any file accessible by the Nix process. This vulnerability shares similarities with other file path traversal vulnerabilities, where crafted input leads to unintended file system modifications.

Systems administrators and developers using Nix for package management, particularly those running Nix with root privileges or in automated build environments, are at significant risk. Shared hosting environments where multiple users have access to the Nix daemon are also particularly vulnerable.

• linux / server:

journalctl -u nix-daemon | grep -i "error writing file"

• linux / server:

find / -type f -name '*.nar' -mtime -7 -print

• linux / server:

ps aux | grep nix-daemon

• linux / server:

ls -l /nix/store | grep -i 'unauthorized'

1. 2024-09-10Disclosure

   disclosure

1. आरक्षित2024-09-02
2. प्रकाशित2024-09-10
3. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-45593 is to immediately upgrade to Nix version 2.24.6 or later. If an immediate upgrade is not feasible, consider restricting access to the Nix daemon and carefully auditing all NAR files before unpacking. Implement strict file system permissions to limit the impact of potential writes. While a WAF is unlikely to be effective here, monitoring for unusual file creation events within the Nix environment can provide early detection. After upgrading, confirm the fix by attempting to unpack a known malicious NAR file (if available) in a controlled environment to verify that the vulnerability is no longer exploitable.