CyberRota Analysis
AI-GeneratedThe vulnerability affects the Nix package manager on Linux systems, specifically prior to version 2.35.0, where a malicious derivation can exploit a time-of-check/time-of-use race condition in symlink handling. This flaw may allow an attacker to create or truncate files outside the build sandbox with the permissions of the nix-daemon, although it does not permit arbitrary content writes. Users and administrators of Nix, particularly those utilizing the recursive-nix experimental feature, should prioritize upgrading to version 2.35.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.