VDB
CVE-2024-45593
CVE-2024-45593
PUBLISHED
CVSS 9.100000381469727 CRITICAL
Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6.
EPSS 0.60% · 46.4th percentile
Risk Scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
EPSS Score
0.60%
46.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| nixos | nix | 2.24.0, 2.24.0, 2.24.0 |
| NixOS | nix | >= 2.24.0, < 2.24.6, >= 2.24.0, < 2.24.6 |
| nixos | nix | 2.24.0, 2.24.0 |
Timeline
- Jan 21, 1970 Security Advisory
- Sep 10, 2024 CVE Published
- Sep 10, 2024 PoC Published
- Sep 11, 2024 EPSS Score
- Sep 16, 2024 PoC Published
- Sep 16, 2024 PoC Published
- Sep 26, 2024 PoC Published
- Oct 1, 2024 EPSS Score
- Oct 5, 2024 Coalition ESS Score
- Oct 21, 2024 EPSS Score
- Nov 10, 2024 EPSS Score
- Nov 30, 2024 EPSS Score