Compliance Impact

The provided information does not include any details on how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Nix before version 2.34.7 and Lix before version 2.95.2. It involves unbounded recursion in the NAR (Nix Archive) parser, which can cause a stack-to-heap overflow when the parser runs on a coroutine stack.

Because the stack is allocated without a guard page, the overflow can overwrite memory on the heap. This memory corruption could allow an attacker to execute arbitrary code as the Nix daemon, which runs with root privileges in multi-user installations.

The vulnerability can be exploited by any user able to connect to the daemon, which by default includes all users unless restricted by configuration.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution with root privileges on systems running vulnerable versions of Nix or Lix. An attacker who can connect to the Nix daemon could exploit this flaw to gain elevated access and potentially take full control of the affected system.

Because the Nix daemon runs as root in multi-user environments, exploitation could compromise system integrity and security, leading to unauthorized actions, data breaches, or disruption of services.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Nix to one of the fixed versions: 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, or 2.29.4 (for versions introduced in 2.24.4). For Lix, upgrade to 2.95.2, 2.94.2, or 2.93.4 (introduced in 2.93.0).

Additionally, review and restrict the allowed-users setting for the Nix daemon to limit which users can connect, reducing the attack surface.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability affects Nix and Lix daemon implementations before certain fixed versions. Detection primarily involves verifying the installed versions of Nix or Lix on your system to determine if they are vulnerable.

You can check the installed version of Nix or Lix using the following commands:

• nix --version
• lix --version

If the version is older than the fixed versions (Nix versions before 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7; Lix versions before 2.95.2, 2.94.2, and 2.93.4), your system is vulnerable.

Since the vulnerability requires local access to the Nix or Lix daemon, you should also check which users are allowed to connect to the daemon by inspecting the daemon configuration, particularly the allowed-users and trusted-users settings.

There are no specific network or system scanning commands provided in the resources to detect exploitation attempts or the vulnerability directly.

Useful 0 Not Useful 0