CVE-2024-36050

What it actually does

Nix mishandles hash cache validation for fetched sources, allowing an attacker-controlled source archive to be substituted for the legitimate one when a maintainer accepts a crafted pull request containing modified inputs that match the cache key incorrectly.

Why it matters to the business

Organizations using Nix for builds risk introducing attacker-controlled source code into their software supply chain, potentially leading to compromised artifacts, backdoors in distributed packages, or loss of build integrity across development and production pipelines.

How an attack unfolds

An attacker forks a Nix-based project, crafts a pull request that manipulates inputs to exploit the hash cache flaw, and lures a maintainer into merging it; once merged, subsequent Nix builds fetch and cache the malicious source instead of the original, persisting the compromise.

How to fix it

Upgrade Nix to a version beyond 2.22.1 that properly validates hash cache entries; review and regenerate any existing caches for projects that may have accepted suspect pull requests; enforce strict review processes for source-fetching expressions.

How to confirm the fix worked

Confirm Nix version is newer than 2.22.1; audit recent merged pull requests for source fetch expressions; test build reproducibility by clearing caches and verifying expected source hashes against trusted references.

Typical attack path

1. Identify a Nix-managed project with public contribution workflow
2. Create a fork and craft a pull request with manipulated source references
3. Social-engineer or wait for maintainer review and merge
4. Trigger builds on merged changes to poison the hash cache
5. Subsequent builds or downstream consumers retrieve attacker-controlled sources

How to detect it

Review build logs and cache directories for unexpected source substitutions; search for recent merges of pull requests that alter fetch expressions; correlate with any post-merge build artifacts showing hash mismatches or unusual content.

What your security team should do

• Immediately upgrade all Nix installations to the latest fixed release
• Scan CI/CD pipelines and developer workstations for Nix versions <= 2.22.1
• Implement mandatory two-person review for changes affecting fetchers or hashes
• Monitor for unexpected source hash mismatches in build logs