Nix and Lix patch local root privilege-escalation flaws

The Nix and Lix projects have jointly disclosed a set of vulnerabilities that can be used to escalate privileges to root on systems running the Nix or Lix daemons.

According to the developers, all systems that build untrusted derivations are affected. That framing matters: the risk is not limited to exotic setups but applies to the common case where a daemon processes build jobs originating from untrusted sources.

Both projects shipped fixed releases on the day of the announcement. CVE identifiers had not yet been requested at the time of disclosure. Details of the vulnerabilities themselves are provided in the projects' joint announcement.

Administrators running Nix or Lix to build packages are advised to update to the patched versions as soon as possible.

Source: LWN.net