CVE-2024-38531

What it actually does

A build process can modify permissions on its directory to place a setuid binary in a world-accessible location, allowing a local attacker to impersonate a Nix daemon worker process and control all subsequent builds.

Why it matters to the business

Compromised builds can introduce malicious artifacts into packages distributed across an organization or its customers, creating supply-chain risk and potential persistent unauthorized access on build hosts.

How an attack unfolds

An attacker with local access to a Nix build host modifies permissions on a build directory, plants a setuid binary, assumes the identity of a Nix daemon worker, and then hijacks future package builds to inject malicious content.

How to fix it

Upgrade Nix to one of the patched releases: 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 or 2.18.4. After upgrade, rebuild any packages that may have been produced under attacker control and audit build directories for unexpected setuid binaries.

How to confirm the fix worked

Run 'nix --version' on all build hosts and confirm the installed version matches a patched release; scan build directories and /nix/store for unexpected setuid or setgid binaries created after the vulnerability disclosure date.

Typical attack path

1. Obtain local user access on a Nix build host
2. Identify or trigger a Nix build that creates a world-writable directory
3. Create or place a setuid binary in a globally accessible path
4. Assume Nix daemon worker privileges via the setuid binary
5. Hijack and alter all future builds performed by the daemon

How to detect it

Review system and Nix daemon logs for permission changes on build directories, unexpected setuid binaries in global paths, and any process executions that switch to daemon worker UIDs outside normal build workflows.

What your security team should do

• Immediately upgrade all Nix installations to a fixed version
• Restrict local user access to build hosts and enforce least-privilege build accounts
• Enable auditing of permission changes and setuid binary creation in build directories
• Monitor build logs for anomalous permission modifications or unexpected binaries