# Vulnerability in Nix 2.24
**URL:** https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902
**Category:** Security
**Created:** [September 10, 2024, 10:22am UTC](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902 "2024-09-10T10:22:10Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@raboof](https://discourse.nixos.org/u/raboof)
#### Post date: [September 10, 2024, 10:22am UTC](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902/1 "2024-09-10T10:22:11Z")
There’s a vulnerability in Nix 2.24.
If you’re using the regular nix from nixpkgs (which the vast majority of users will be), you’re still on a safe version. If you recently (after August 1st) installed nix using the nix (not NixOS) installers, or are using nixVersions.git from nixpkgs, then you need to double-check. A fix is expected in version 2.24.6 which is to be released soon.
GHSA-h4vv-h3jq-v493
---
### Author:  [@fricklerhandwerk](https://discourse.nixos.org/u/fricklerhandwerk)
#### Post date: [September 10, 2024, 11:00am UTC](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902/2 "2024-09-10T11:00:05Z")
To summarize:
- This vulnerability allows privilege escalation, so it’s serious
- It only affects Nix 2.24.0 to 2.24.5
- The known attack vectors are closed in Nix 2.24.6
Please excuse any delay; we will publish a post mortem once the acute situation is cleaned up.
In the meantime, if you installed or upgraded Nix recently (after 2024-08-01 and before 2024-09-10):
- If you installed Nix standalone using the official installer, as found on
- If you installed Nix using [the Determinate Systems installer](https://github.com/DeterminateSystems/nix-installer), then please update to 2.24.6 by [upgrading](https://github.com/DeterminateSystems/nix-installer/tree/main?tab=readme-ov-file#upgrading-nix), or by [uninstalling](https://github.com/DeterminateSystems/nix-installer/tree/main?tab=readme-ov-file#uninstalling) and re-running the Determinate Systems installer.
- If you set [`nixVersions.git`](https://search.nixos.org/packages?show=nixVersions.git) or [`nixVersions.nix_2_24`](https://search.nixos.org/packages?channel=unstable&show=nixVersions.nix_2_24) in your NixOS, Home Manager, or `nix-darwin` configuration, update your Nixpkgs pin and rebuild the system. Otherwise you don’t need to do anything.
[Lix](https://lix.systems/) is not affected because it was forked off Nix 2.18. The vulnerability was reported by Lix core team member @puckipedia.
Mentioned elsewhere, for reference:
- [Nix 2.24+ is vulnerable to (remote) privilege escalation | Lobsters](https://discourse.nixos.org/t/nix-2-24-is-vulnerable-to-remote-privilege-escalation-lobsters/51890)
- [Determinate Status - Uncoordinated disclosure of a Nix 2.24 privilege escalation vulnerability](https://status.determinate.systems/incidents/1js0r53719f4)
---
### Author:  [@fricklerhandwerk](https://discourse.nixos.org/u/fricklerhandwerk)
#### Post date: [September 10, 2024, 11:54am UTC](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902/3 "2024-09-10T11:54:29Z")
The GitHub advisory is now public: [Unsafe NAR unpacking · Advisory · NixOS/nix · GitHub](https://github.com/NixOS/nix/security/advisories/GHSA-h4vv-h3jq-v493)
And 2.24.6 is released: [Release 2.24.6 · NixOS/nix · GitHub](https://github.com/NixOS/nix/releases/tag/2.24.6)
---
### Author:  [@Sandro](https://discourse.nixos.org/u/Sandro)
#### Post date: [September 10, 2024, 1:40pm UTC](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902/4 "2024-09-10T13:40:01Z")
Thanks for the quick fixes now that the exploit is public.
---
### Author:  [@Aleksanaa](https://discourse.nixos.org/u/Aleksanaa)
#### Post date: [September 11, 2024, 1:16am UTC](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902/5 "2024-09-11T01:16:55Z")
I saw the remedy was about case insensitivity. I suppose case sensitive filesystems are not affected?
---
### Author:  [@waffle8946](https://discourse.nixos.org/u/waffle8946)
#### Post date: [September 11, 2024, 1:36am UTC](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902/6 "2024-09-11T01:36:43Z")
How so? The original explanation mentioned it was due to improper hash verification and symlink handling
---
### Author:  [@tomberek](https://discourse.nixos.org/u/tomberek)
#### Post date: [September 11, 2024, 1:41pm UTC](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902/7 "2024-09-11T13:41:31Z")
Case-sensitivity was only one of the vectors. There are a class of similar bugs that abuse a similar mechanism of defining a symlink with an arbitrary target and then later traversing that symlink as a way to get write access as root. Other mechanisms include messing with the ordering of NAR entries and unicode representations.
---
### Author:  [@fricklerhandwerk](https://discourse.nixos.org/u/fricklerhandwerk)
#### Post date: [September 17, 2024, 8:51pm UTC](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902/8 "2024-09-17T20:51:03Z")
Here’s the post mortem as promised:
> [@NAR unpacking vulnerability -- post mortem](https://discourse.nixos.org/t/nar-unpacking-vulnerability-post-mortem/52301):
>
> Last week there was a period of 14 hours where the mechanism of a [serious security vulnerability in Nix 2.24](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902) was publicly known but no patch available. The following reconstructs what led up to that, and lists the conclusions Nix maintainers (@edolstra @tomberek @Ericson2314 @roberth @fricklerhandwerk) draw from the incident. Summary of events Nix maintainers were first informed of the vulnerability on Friday 2024-08-30 on Matrix by @puckipedia, with an advance warning on GitHub by @jade. @tomb…