Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as "valid" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7633-1 advisory.

    Linus Heckemann discovered that Nix did not correctly handle certain binaries. An attacker could possibly     use this issue to execute arbitrary code. (CVE-2024-38531)

    Pierre-Etienne Meunier discovered that Nix did not correctly handle TLS certificates. A remote attacker     could possibly use this issue to leak sensitive information. (CVE-2024-47174)

    It was discovered that Nix did not correctly handle Unix sockets. An attacker could possibly use this     issue execute arbitrary code. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-27297)

    It was discovered that Nix did not correctly handle unpacking Nix archives (NARS). If a user or automated     system were tricked into opening a specially crafted file, an attacker could possibly use this issue to     cause a denial of service or execute arbitrary code. (CVE-2024-45593)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send
    file descriptors to files in the Nix store to another program running on the host (or another fixed-output
    derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the
    derivation, after Nix has registered the path as "valid" and immutable in the Nix database. In particular,
    this allows the output of fixed-output derivations to be modified from their expected content. This issue
    has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no
    known workarounds for this vulnerability. (CVE-2024-27297)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send     file descriptors to files in the Nix store to another program running on the host (or another fixed-output     derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the     derivation, after Nix has registered the path as valid and immutable in the Nix database. In particular,     this allows the output of fixed-output derivations to be modified from their expected content. This issue     has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no     known workarounds for this vulnerability. (CVE-2024-27297)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 / 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5669 advisory.

    -----BEGIN PGP SIGNED MESSAGE-----     Hash: SHA512

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5669-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     April 22, 2024                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : guix     CVE ID         : CVE-2024-27297

    It was discovered that insufficient restriction of unix daemon sockets     in the GNU Guix functional package manager could result in sandbox     bypass.

    For the oldstable distribution (bullseye), this problem has been fixed     in version 1.2.0-4+deb11u2.

    For the stable distribution (bookworm), this problem has been fixed in     version 1.4.0-3+deb12u1.

    We recommend that you upgrade your guix packages.

    For the detailed security status of guix please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/guix

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmYmEj0ACgkQEMKTtsN8     TjadOg//QNwxj1LaUW92byZO1DaMWzwnPElHIwwgTUIWj2NCxZQbumPb6PF0AnYq     n15GcHY1y3jvJ9VnvLI7uns82Gtjqhr9m/sfrDnX/9JPlLBNXTdjQ3/mpECUp6aU     BvN+kmw4irmsfXqtWR33nrdxID+/mCuDfDHM0Cl64JSbrntqOhpRbkML3DNOdWs0     h6BeIhFRoGkLLzh2M8U9uyivrLwrlf8ONem4kmn0xtRowc2Y/0GSg/fJIJPwR3/K     j8FmuydKkm3oVNITr2z2f+b9mzSxXbC7tOgoA6o7Vuxc3Ha7cGn9DojFWKV5DCPv     VFMKjeos9ELIetmSA/GtSMqTn5rV2QlRWHvUnxtGTyewHsz4j/cXXo5F59f+t2zB     LZ8aAlzbM5c5/ZVhQVNnuzY8ueaPkOAyFkdawPjSTis0S0KYjgz9/4F8peYNEyJ7     GUgS2b9aXp3j1dLPKjXDXHXUNL3quemK3aUZCZElgsGN6oHZnOvf/t04jL9BN0/o     gL7wShs2ZsS/AQ7HRQ+OuYTTcs8patbgitCKI74u8oS/ArrG/U4TfgKhwqFaAICX     x5cJFreSKzhTQWIhGaxPY73s1zDy5KyLBQjQ67DPbqqYcCC0SwrUFegYrOllORnj     TLlkkG7vkelx/PxYqzy+YrWeoHt/jdSTR8j5bn1XEYPa/4MZrIg=     =0oSL
    -----END PGP SIGNATURE-----

    Reply to:
    debian-security-announce@lists.debian.org     Moritz Muehlenhoff (on-list)     Moritz Muehlenhoff (off-list)

    Prev by Date:
    [SECURITY] [DSA 5668-1] chromium security update

    Next by Date:
    [SECURITY] [DSA 5670-1] thunderbird security update

    Previous by thread:
    [SECURITY] [DSA 5668-1] chromium security update

    Next by thread:
    [SECURITY] [DSA 5670-1] thunderbird security update

    Index(es):

    Date     Thread

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242201	Ubuntu 22.04 LTS / 24.04 LTS : Nix vulnerabilities (USN-7633-1)	Nessus	Ubuntu Local Security Checks	high
426052	Alpine: multiple nix packages, perl-nix: security update to 2.20.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
426052	Alpine: multiple nix packages, perl-nix: security update to 2.20.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
228121	Linux Distros Unpatched Vulnerability : CVE-2024-27297	Nessus	Misc.	medium
193698	Debian dsa-5669 : guix - security update	Nessus	Debian Local Security Checks	medium
408321	Alpine: multiple guix packages: security update to 1.4.0-r5	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
408321	Alpine: multiple guix packages: security update to 1.4.0-r5	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium

Detections

Analytics

CVE-2024-27297

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium