{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-27297 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2024-27297 is a medium-severity vulnerability in NixOS nix, published on 11 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-27297 and fix it if it is affected.\n\nWhat it is: CVE-2024-27297 is a medium-severity vulnerability in NixOS nix, published on 11 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-27297 in the wild and no public exploit code.\n\nAffected product: NixOS nix. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-27297/ (Markdown: https://insights.sbomify.com/CVE-2024-27297/index.md)","id":"CVE-2024-27297","markdown":"https://insights.sbomify.com/CVE-2024-27297/index.md","name":"CVE-2024-27297","record":{"aliases":["DEBIAN-CVE-2024-27297","DSA-5669-1","GHSA-2ffj-w4mj-pg37","UBUNTU-CVE-2024-27297"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["data_modify"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Nix package manager","requires_auth":"low_privilege","summary":"Attackers can modify fixed-output derivation contents after validation via Unix domain sockets, compromising package integrity in Nix.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"nix","vendor":"nixos"}],"cvss":{"score":6.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"cwes":[{"id":"CWE-367","name":"Time-of-check Time-of-use (TOCTOU) Race Condition"}],"description":"Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as \"valid\" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Nix Corruption of fixed-output derivations","id":"CVE-2024-27297","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2024"},"n_packages":0,"n_references":3,"next":{"headline":"Parse Server literalizeRegexPart SQL Injection","id":"CVE-2024-27298"},"packages":[],"prev":{"headline":"Directus version number disclosure","id":"CVE-2024-27296"},"products":["nix"],"published":"2024-03-11","related":[{"cvss_score":9.1,"headline":"Nix affected by unsafe NAR unpacking","id":"CVE-2024-45593","kev_date_added":null,"published":"2024-09-10"},{"cvss_score":9,"headline":"Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination","id":"CVE-2026-39860","kev_date_added":null,"published":"2026-04-08"},{"cvss_score":7.8,"headline":"Misconfiguration in n/a","id":"CVE-2019-17365","kev_date_added":null,"published":"2019-10-09"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-06-27","vendors":["NixOS"]},"summary":"Attackers can modify fixed-output derivation contents after validation via Unix domain sockets, compromising package integrity in Nix.","url":"https://insights.sbomify.com/CVE-2024-27297/"}