Improper Check For Unusual Or Exceptional Conditions

Nix is vulnerable to a Improper Check for Unusual or Exceptional Conditions which can send file descriptors to files in the Nix store to another program running on the host or another fixed-output derivation through Unix domain sockets in the abstract namespace. This allows the modification of the output of the derivation after Nix has registered the path as “valid” and immutable in the Nix database, enabling the output of fixed-output derivations to be altered from their expected content.