CVE catalog
CVE-2024-45593
Nix vulnerabilities
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.60% · Oct 25, 2026
Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | nix | sid | 2.34.8+dfsg-1 | not affected |
| Debian | nix | forky | 2.34.8+dfsg-1 | not affected |
| Debian | nix | trixie | 2.26.3+dfsg-1 | not affected |
| Debian | nix | bookworm | 2.8.0-1.1 | not affected |
| Ubuntu | nix | noble | 2.18.1+dfsg-1ubuntu5+esm2 | fixed |
| Ubuntu | nix-bin | noble | 2.18.1+dfsg-1ubuntu5+esm2 | fixed |
| Ubuntu | nix-setup-systemd | noble | 2.18.1+dfsg-1ubuntu5+esm2 | fixed |
| Ubuntu | nix | pro | 2.16.1+dfsg-3ubuntu1 | vulnerable |
| Ubuntu | nix | pro | 2.18.1+dfsg-1ubuntu1 | vulnerable |
| Ubuntu | nix | pro | 2.18.1+dfsg-1ubuntu2 | vulnerable |
| Ubuntu | nix | pro | 2.18.1+dfsg-1ubuntu4 | vulnerable |
| Ubuntu | nix | pro | 2.18.1+dfsg-1ubuntu5 | vulnerable |
| Ubuntu | nix | pro | 2.18.1+dfsg-1ubuntu5+esm2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | nix | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | nix | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | nix | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | nix | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Ubuntu | nix | deb | noble | 2.18.1+dfsg-1ubuntu5+esm2 | Not reported | Not reported | Not reported |
| Ubuntu | nix-bin | deb | noble | 2.18.1+dfsg-1ubuntu5+esm2 | Not reported | Not reported | Not reported |
| Ubuntu | nix-setup-systemd | deb | noble | 2.18.1+dfsg-1ubuntu5+esm2 | Not reported | Not reported | Not reported |
| Ubuntu | nix | deb | pro | 2.18.1+dfsg-1ubuntu5+esm2 | Not reported | UBUNTU-CVE-2024-45593 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [nix-bin]Not affected
Source package: [nix]
Details (2)
2.8.0-1.1· arm64 · bookwormNot affected
usn · nix · debian · bookworm
2.8.0-1.1+b1· amd64 · bookwormNot affected
usn · nix · debian · bookworm
- [nix-setup-systemd]Not affected
Source package: [nix]
Details (2)
2.8.0-1.1· all · bookwormNot affected
usn · nix · debian · bookworm
2.8.0-1.1· all · bookwormNot affected
usn · nix · debian · bookworm
Observed: