Description

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.8",
  "pubDate": "2026-08-20T17:19:16.813Z",
  "pubdate": "2026-08-20T17:19:16.813Z",
  "executiveSummary": "A time-of-check to time-of-use (TOCTOU) race condition vulnerability exists in the Nix package manager within the LocalStore restore path, specifically involving final symlink handling during the execution of a malicious derivation using the recursive-nix experimental feature. This security flaw affects Nix versions prior to 2.35.0.\nThe vulnerability allows a malicious local derivation to manipulate file system resolution, causing the writeFile operation to follow a substituted final symlink when opening a target path with the O_TRUNC flag instead of correctly enforcing FinalSymlink::DontFollow semantics. Consequently, this flaw enables the Nix process or the running nix-daemon to create or truncate an empty file outside the intended build sandbox under the security context of the daemon user.\nThe inherent risk implication involves unauthorized file creation and truncation on the host file system. However, exploitation of this primitive is constrained as it does not permit arbitrary-content writes, is limited to zero-byte file operations, and strictly requires successfully winning a timing-dependent race condition during the build and restoration process.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate enforcement of symlink traversal restrictions during the file restoration phase within the LocalStore component of Nix. Specifically, when utilizing the recursive-nix experimental feature, a malicious derivation can orchestrate a time-of-check to time-of-use (TOCTOU) race condition targeting final symlink handling.\nDuring normal secure operations, path resolution within the restore path is expected to enforce FinalSymlink::DontFollow to prevent the system from resolving symlinks that point outside the secure build sandbox. However, due to the race condition, an attacker-controlled process can substitute a valid path with a malicious symlink precisely between the security check (time-of-check) and the actual file open operation utilizing the O_TRUNC flag (time-of-use).\nThe attack flow proceeds as follows: First, a malicious derivation is executed with the recursive-nix experimental feature enabled. Second, the derivation initiates concurrent file system modifications to induce a timing window within the LocalStore restore path. Third, the Nix process or the privileged nix-daemon evaluates a target path, passing the initial security check. Fourth, immediately following the check, the derivation swaps the expected structure with a final symlink pointing to an arbitrary destination path on the host system. Finally, when the daemon opens the path using O_TRUNC, it follows the substituted symlink rather than adhering to FinalSymlink::DontFollow.\nThe vulnerable component is the LocalStore restore path handling logic within Nix. Affected versions include all releases prior to 2.35.0. Regarding prerequisites and exposure, the attack vector is local, requiring the execution of a malicious derivation with the recursive-nix experimental feature enabled. No specialized network exposure is required, and authentication prerequisites depend on the local execution context of the build. The payload behavior is strictly limited to creating or truncating empty files (zero-byte writes) leveraging the privileges of the nix-daemon user, preventing arbitrary-content code execution but potentially leading to denial-of-service or integrity violations of critical system files."
}