CVE-2025-52992
BaseFortify
Publication date: 2025-06-27
Last updated on: 2025-06-30
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-732 | The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the Nix, Lix, and Guix package managers. When a derivation build fails, these package managers fail to properly set permissions, which may allow arbitrary processes to modify the content of the store outside of the build sandbox. This can lead to unauthorized privilege escalation within the package manager environment. [1]
How can this vulnerability impact me? :
The vulnerability can allow unauthorized processes to modify files outside the intended build sandbox, potentially leading to local privilege escalation. This means an attacker with local access could manipulate build outputs or store contents, compromising system integrity and security until the vulnerability is patched. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability CVE-2025-52992 affecting Nix, Lix, and Guix package managers, users should update to fixed versions as soon as they become available. For Lix, users are strongly advised to upgrade to versions 2.91, 2.92, or 2.93, which include fixes such as replacing path-based operations with file descriptor-based APIs, securing build staging directories, and isolating network namespaces. On NixOS, upgrade Lix pins or apply patches manually if necessary. On non-NixOS Linux and macOS, upgrade via the Lix installer or use 'nix upgrade-nix'. For Guix, monitor for released patched versions and apply them promptly. These steps help prevent unauthorized privilege escalation by ensuring proper permission handling and sandboxing during builds. [1, 2]