NixOS Nix CVE-2019-17365 Local Privilege Escalation Vulnerability

Description

NixOS Nix is prone to a local privilege-escalation vulnerability. An attacker may exploit this issue to gain elevated privileges. Successful exploits may aid in further attacks. Nix versions through 2.3 are vulnerable.

Technologies Affected

• NixOS Nix 1.0
• NixOS Nix 1.5
• NixOS Nix 1.9
• NixOS Nix 2.0
• NixOS Nix 2.0.1
• NixOS Nix 2.0.4
• NixOS Nix 2.1
• NixOS Nix 2.2
• NixOS Nix 2.3

Recommendations

Permit local access for trusted individuals only. Where possible, use restricted environments and restricted shells.
Restrict local access to trusted and accountable individuals only.

Run all software as a nonprivileged user with minimal access rights.
To reduce the impact of latent vulnerabilities, always run nonadministrative software as an unprivileged user with minimal access rights.

Updates are available. Please see the references or vendor advisory for more information.