Skip to content
OpenAdvisories
High USN-8773-1 2 CVEs

guix vulnerability

Published Sep 16, 2026 · Updated Sep 16, 2026

Ecosystem: Ubuntu

Summary

It was discovered that GNU Guix incorrectly made build outputs accessible
to local users before their file metadata was finalized. A local attacker
could possibly use this issue to gain elevated privileges.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS guix 1.3.0-4ubuntu0.1~esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS guix 1.4.0-6ubuntu0.1~esm1

Vulnerabilities 2

  • High 8.1
    CVE-2024-52867

    guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users …

    guix guix Debian Ubuntu
  • Medium 6.3
    CVE-2024-27297

    Nix Corruption of fixed-output derivations

    Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstr…

    NixOS Nix nix nix Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2024-27297
  • report
    https://ubuntu.com/security/CVE-2024-52867