# CVE-2024-27297: Nix Corruption of fixed-output derivations

> Attackers can modify fixed-output derivation contents after validation via Unix domain sockets, compromising package integrity in Nix.

- **Severity:** Medium 6.3 (`CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 11 Mar 2024
- **Updated:** 27 Jun 2025
- **Also known as:** DEBIAN-CVE-2024-27297, DSA-5669-1, GHSA-2ffj-w4mj-pg37, UBUNTU-CVE-2024-27297

## What is CVE-2024-27297?

CVE-2024-27297 is a medium-severity vulnerability in NixOS nix, published on 11 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as "valid" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)

## Which versions are affected by CVE-2024-27297?

It affects 1 product.


Products: Nixos Nix.

## How do I fix CVE-2024-27297?

Upgrade to a fixed version.

## Is CVE-2024-27297 being exploited?

There is no known exploitation of CVE-2024-27297 in the wild and no public exploit code.

## Other vulnerabilities in NixOS nix

- [CVE-2024-45593](https://insights.sbomify.com/CVE-2024-45593/): Nix affected by unsafe NAR unpacking (critical 9.1)
- [CVE-2026-39860](https://insights.sbomify.com/CVE-2026-39860/): Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination (critical 9.0)
- [CVE-2019-17365](https://insights.sbomify.com/CVE-2019-17365/): Misconfiguration in n/a (high 7.8)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2024-27297 and fix it if it is affected.

What it is: CVE-2024-27297 is a medium-severity vulnerability in NixOS nix, published on 11 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2024-27297 in the wild and no public exploit code.

Affected product: NixOS nix. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2024-27297/ (Markdown: https://insights.sbomify.com/CVE-2024-27297/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2024-27297
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-27297
- OSV: https://osv.dev/vulnerability/CVE-2024-27297

---
From sbomify Insights: https://insights.sbomify.com/CVE-2024-27297/
Summaries are generated and may contain mistakes; the official description above is the record.