CVSS 3.1 Score 6.3 of 10 (medium)


Published Mar 11, 2024
Updated: Mar 12, 2024
CWE ID 367


CVE-2024-27297 is a vulnerability found in the Nix package manager for Linux and Unix systems. It allows fixed-output derivations on Linux to send file descriptors to files in the Nix store, which can then be modified by another program via Unix domain sockets. This means that the output of fixed-output derivations can be altered after Nix has registered it as "valid" and immutable. The vulnerability has been addressed in versions 2.3.18, 2.18.2, 2.19.4, and 2.20.5 of Nix, and users are advised to upgrade to these versions to mitigate the issue. There are currently no known workarounds for this vulnerability, which has a base score of 6.3 (medium severity) according to the CVSS:3.1 scoring system. The impact score is 4.2, with low attack complexity and low availability impact, but high integrity impact. Note: The information provided is based on the given text and does not contain any subjective statements or analysis beyond the facts presented in the original text.

Leverage our Vulnerability Intelligence module to secure your systems now - get detailed insights on CVE-2024-37364. Book your demo today.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-27297 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options