Security Advisory: Local privilege escalation in Lix and Nix

Announcements Security
1

Summary

Nix and Lix daemon implementations are affected by buffer overflows vulnerabilities that allow a local attacker to gain arbitrary code execution as the daemon user (root in multi-user installations).
The vulnerabilities are identified as:

This is a coordinated disclosure between the Nix and Lix projects.

Guix is NOT affected by this vulnerability.

Am I affected?

To exploit this issue, a local attacker needs access to talk to the Nix daemon. All systems that allow connections to their daemons are affected. Only users that are allowed to connect to the daemon (via allowed-users and trusted-users) can reliably trigger the issue. Substituters can in theory trigger the issue but cannot make enough attempts to mount attacks in practice.

Additionally, this vulnerability requires ASLR weakening techniques to lead to a compromise.

Fixes

The vulnerabilities are fixed in the following versions:

Nix security release also includes patches that address an unrelated path traversal vulnerability GHSA-gr92-w2r5-qw5p (CVE ID pending attribution).

To make exploiting this class of vulnerabilities harder, NixOS has been patched to increase the effectiveness of ASLR #510943.

Acknowledgement

  • We would like to thank @edef with the help of Sander (@sandydoo) for reporting the issues and working with the development teams to suggest and confirm the fixes.
  • Thanks to eldritch horrors (@pennae) and Raito Bezarius (@RaitoBezarius) on the Lix side for the mitigation.
  • Thanks to @xokdvium on the Nix side for the mitigation.
  • Thanks to @hexa and @tgerbet on the NixOS security team for coordinating this.
60 Likes
Home-manager w/o ā€˜allowed-usersā€˜?
Nix-shell and $TMP / $TMPDIR
3

Canā€™t edit the post, but the Nix update PRs in nixpkgs are:

8 Likes
4

Lix has now published its in-depth analysis of the security vulnerability here: Lix | An exploitable integer overflow in Lix (CVE-2026-44028) .

If you find out something that looks wrong in that post (typo or anything), feel free to DM me about it.

9 Likes
5

It would be useful to include the information in your ā€œAm I affected?ā€ paragraph above in the Lix post. Currently it only explains how to check if you are vulnerable, but it took me a moment to figure out what I was vulnerable to.

6

This is now done, thank you.

2 Likes
7

I believe that all the 6 maintained channels contain these updates now.

4 Likes
8

Is there any example of exploit to gain root access?

I have a NAS which I log into very rarely and I forgot the sudo password as I log in via ssh key and denied root loginā€¦ I tried the 2 recent Linux CVE and they didnā€™t work. I can provide any proof needed that the machine Iā€™m trying to use an exploit on is mine and Iā€™m the only user of it.

MP me if you prefer :slight_smile: Otherwise Iā€™ll reinstall after backing up the configuration.nix but that means unplug it without shutting down to bring it near a screen and keyboard ^^ā€™

2 Likes