nixVersions.nix_2_3: add knownVulnerabilities#420974
Merged
alyssais merged 2 commits intoNixOS:masterfrom Jun 30, 2025
Merged
Conversation
alyssais
force-pushed
the
nix_2_3-vulnerabilities
branch
from
48b082c to
e216a82
Compare
alyssais
changed the title
nix-owners
bot
requested review from
Ericson2314,
Mic92,
RaitoBezarius,
edolstra,
roberth,
tomberek and
xokdvium
alyssais
force-pushed
the
nix_2_3-vulnerabilities
branch
3 times, most recently
from
52ec7b0 to
3997403
Compare
alyssais
force-pushed
the
nix_2_3-vulnerabilities
branch
from
3997403 to
a60390d
Compare
nixpkgs-ci
bot
added
10.rebuild-linux: 1-10
mweinelt
added
the
1.severity: security
alyssais
force-pushed
the
nix_2_3-vulnerabilities
branch
4 times, most recently
from
4aaa1b1 to
a0a12bf
Compare
nixpkgs-ci
bot
added
the
6.topic: continuous integration
alyssais
commented
Jun 29, 2025
alois31
reviewed
Jun 29, 2025
alyssais
force-pushed
the
nix_2_3-vulnerabilities
branch
from
a0a12bf to
da1b7d4
Compare
alyssais
force-pushed
the
nix_2_3-vulnerabilities
branch
from
da1b7d4 to
ba03474
Compare
wolfgangwalther
approved these changes
Jun 29, 2025
Contributor
wolfgangwalther
left a comment
wolfgangwalther
left a comment
There was a problem hiding this comment.
Reading through: LGTM.
nixpkgs-ci
bot
added
the
12.approvals: 1
It doesn't make sense for release.nix to run these twice; once directly, and once as part of the tarball job.
alyssais
force-pushed
the
nix_2_3-vulnerabilities
branch
from
ba03474 to
1666082
Compare
flokli
approved these changes
Jun 30, 2025
Contributor
|
Backport failed for Please cherry-pick the changes locally and resolve any conflicts. git fetch origin release-24.11
git worktree add -d .worktree/backport-420974-to-release-24.11 origin/release-24.11
cd .worktree/backport-420974-to-release-24.11
git switch --create backport-420974-to-release-24.11
git cherry-pick -x 1063473001bb85bf3af2fe21f3a76011ea8c558b a61841a597730a4ec18be3f87a257a3989e629dd |
Contributor
|
Successfully created backport PR for |
github-actions
bot
added
the
8.has: port to stable
1 task
nixpkgs-ci
bot
added
12.approvals: 2
Member
|
@alyssais We are backporting the most critical patches here: tvlfyi/nix#5 These are specifically the patches from Lix, not from C++ Nix. For the other CVEs we haven't decided what to do yet, in particular porting something like pasta or the other solutions to that problem doesn't look attractive until there's more real-world experience with them from the early adopters. |
13 tasks
| "CVE-2024-38531" | ||
| "CVE-2024-47174" | ||
| "CVE-2025-46415" | ||
| "CVE-2025-46416" |
Member
There was a problem hiding this comment.
From my understanding, also later versions of nix are vulnerable to CVE-2025-46416 since abstract unix sockets can be created in the main network namespace. So we should add it to knownVulnerabilities for the other packages in nixVersions for consistency?!
Contributor
There was a problem hiding this comment.
That weakness about abstract domain sockets is still present, but not the vulnerability described in the CVE. Known exploit chains are fixed.
wolfgangwalther
added
the
8.has: port to stable
This was referenced Jul 22, 2025
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hopefully somebody backports the patches, in which case we can revert this, and if not it will give us a good indication that nobody cares about getting Nix 2.3 from Nixpkgs and we can drop it.
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.