CVE-2024-45593

What it actually does

Path traversal in NAR unpacking allows writing to arbitrary filesystem paths with the privileges of the Nix process, including root via the daemon.

Why it matters to the business

Attackers can overwrite critical system files, install persistent malware, or disrupt package management across Unix environments, leading to full host compromise and operational downtime.

How an attack unfolds

An attacker acting as a substituter or supplying a malicious NAR crafts a specially formed archive that exploits insufficient path validation during unpacking; when Nix processes the NAR, it writes attacker-controlled content to chosen locations outside the intended store, potentially replacing binaries or configuration with root privileges.

How to fix it

Upgrade Nix to version 2.24.6 or later; for nixos/nix apply commit eb11c1499876cd4c9c188cbda5b1003b36ce2e59. Restrict untrusted substituters and review NAR sources until patched.

How to confirm the fix worked

Confirm Nix reports version 2.24.6 or newer; test unpacking of known-good NARs in a sandbox and verify no writes occur outside the Nix store.

Typical attack path

1. Register a malicious substituter or serve a crafted NAR to a target Nix installation
2. Trigger package fetch or build that causes Nix to unpack the NAR
3. Exploit path traversal to write files to arbitrary locations such as /etc or /root
4. Achieve persistence or privilege escalation by replacing system binaries or startup scripts

How to detect it

Review Nix daemon and build logs for NAR unpacking events that reference unexpected paths; look for file modification timestamps on system directories that coincide with package operations.

What your security team should do

• Immediately upgrade all Nix installations to the fixed version
• Audit and restrict substituter configurations to trusted sources only
• Monitor package build and fetch logs for unexpected file writes