CVE-2024-27297
CVSS 3.1 Score 6.3 of 10 (medium)
Details
Summary
CVE-2024-27297 is a vulnerability found in the Nix package manager for Linux and Unix systems. It allows fixed-output derivations on Linux to send file descriptors to files in the Nix store, which can then be modified by another program via Unix domain sockets. This means that the output of fixed-output derivations can be altered after Nix has registered it as "valid" and immutable. The vulnerability has been addressed in versions 2.3.18, 2.18.2, 2.19.4, and 2.20.5 of Nix, and users are advised to upgrade to these versions to mitigate the issue. There are currently no known workarounds for this vulnerability, which has a base score of 6.3 (medium severity) according to the CVSS:3.1 scoring system. The impact score is 4.2, with low attack complexity and low availability impact, but high integrity impact. Note: The information provided is based on the given text and does not contain any subjective statements or analysis beyond the facts presented in the original text.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions