Nix and Lix Buffer Overflow Vulnerabilities Allow Local Code Execution as Root
Patch Nix and Lix to fix buffer overflows in daemons and prevent local code execution as root.
Apply the latest patches to Nix and Lix or upgrade to a fixed version.
Summary
A coordinated disclosure has revealed critical buffer overflow bugs in the Nix and Lix package manager daemons, allowing local attackers to gain arbitrary code execution. The Nix vulnerability, identified as GHSA‑vh5x‑56v6‑4368, is pending a CVE ID from MITRE. The Lix vulnerability is also pending attribution, but both affect the daemon user, which is root in multi‑user installations. An attacker can exploit the overflow to execute arbitrary code with root privileges, potentially compromising the entire system. The vulnerabilities are not present in Guix, which remains unaffected. The disclosure includes detailed exploit code and mitigations, urging users to apply patches immediately. Both projects have acknowledged the issue and are working on fixes. Users should update to the latest patched versions or apply the provided workarounds to mitigate the risk.
Key changes
- Nix GHSA‑vh5x‑56v6‑4368 pending CVE
- Lix CVE pending attribution
- Both affect daemon user running as root
- Local attacker can gain arbitrary code execution
- Guix not affected
- Disclosure includes exploit code and mitigations
- Projects acknowledging issue and working on fixes
- Users should update to patched versions