[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEKWRDx59r1CF6k9s735O86g0DbDdZL9uhfE1K3UUm-M":3,"g5a-risk:CVE-2024-27297":140},{"success":4,"data":5,"meta":137},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":42,"epssPercentile":29,"epssTimeSeries":43,"severity":44,"affectedProducts":45,"affectedProductsCount":51,"references":52,"referencesCount":77,"weaknesses":78,"weaknessesCount":51,"isActivelyExploited":87,"cisaInfo":29,"otxData":29,"relatedBlogPosts":88,"seoMetadata":89,"configurations":114,"relatedVendorCves":135,"notableEvents":136},"CVE-2024-27297","What is CVE-2024-27297?","Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as \"valid\" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another...","2024-03-11T22:15:55.277","2026-06-17T07:19:35.82",5.9,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":39,"CVSSMetricV2":40,"CVSSMetricV40":41},[16,32],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":30,"ImpactScore":31},"security-advisories@github.com","Secondary",{"Version":20,"VectorString":21,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":23,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":24,"IntegrityImpact":26,"AvailabilityImpact":23,"BaseScore":27,"BaseSeverity":28,"ExploitCodeMaturity":29,"RemediationLevel":29,"ReportConfidence":29,"TemporalScore":29,"TemporalSeverity":29,"ConfidentialityRequirement":29,"IntegrityRequirement":29,"AvailabilityRequirement":29,"ModifiedAttackVector":29,"ModifiedAttackComplexity":29,"ModifiedPrivilegesRequired":29,"ModifiedUserInteraction":29,"ModifiedScope":29,"ModifiedConfidentialityImpact":29,"ModifiedIntegrityImpact":29,"ModifiedAvailabilityImpact":29,"EnvironmentalScore":29,"EnvironmentalSeverity":29},"3.1","CVSS:3.1\u002FAV:A\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:L","ADJACENT_NETWORK","LOW","NONE","UNCHANGED","HIGH",6.3,"MEDIUM",null,2.1,4.2,{"Source":33,"Type":34,"CVSSData":35,"ExploitabilityScore":37,"ImpactScore":38},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":36,"AttackComplexity":26,"PrivilegesRequired":24,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":24,"IntegrityImpact":26,"AvailabilityImpact":24,"BaseScore":12,"BaseSeverity":28,"ExploitCodeMaturity":29,"RemediationLevel":29,"ReportConfidence":29,"TemporalScore":29,"TemporalSeverity":29,"ConfidentialityRequirement":29,"IntegrityRequirement":29,"AvailabilityRequirement":29,"ModifiedAttackVector":29,"ModifiedAttackComplexity":29,"ModifiedPrivilegesRequired":29,"ModifiedUserInteraction":29,"ModifiedScope":29,"ModifiedConfidentialityImpact":29,"ModifiedIntegrityImpact":29,"ModifiedAvailabilityImpact":29,"EnvironmentalScore":29,"EnvironmentalSeverity":29},"NETWORK",2.2,3.6,[],[],[],0.00586,[42,42,42,42,42,42,42],"Medium",[46],{"vendor":47,"product":48,"version":49,"criteria":50,"vulnerable":4},"nixos","nix","*","cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",1,[53,58,62,67,69,71,75],{"url":54,"source":55,"tags":56},"https:\u002F\u002Fgithub.com\u002FNixOS\u002Fnix\u002Fcommit\u002Ff8170ce9f119e5e6724eb81ff1b5a2d4c0024000","GitHub",[57],"Patch",{"url":59,"source":55,"tags":60},"https:\u002F\u002Fgithub.com\u002FNixOS\u002Fnix\u002Fsecurity\u002Fadvisories\u002FGHSA-2ffj-w4mj-pg37",[61],"Vendor Advisory",{"url":63,"source":64,"tags":65},"https:\u002F\u002Fhackmd.io\u002F03UGerewRcy3db44JQoWvw","Hackmd",[66],"Exploit",{"url":54,"source":55,"tags":68},[57],{"url":59,"source":55,"tags":70},[61],{"url":72,"source":73,"tags":74},"https:\u002F\u002Fguix.gnu.org\u002Fen\u002Fblog\u002F2025\u002Fprivilege-escalation-vulnerabilities-2025\u002F","Gnu",[],{"url":63,"source":64,"tags":76},[66],7,[79],{"id":80,"name":81,"description":82,"extendedDescription":83,"status":84,"abstraction":85,"structure":86},"CWE-367","Time-of-check Time-of-use (TOCTOU) Race Condition","The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.","This weakness can be security-relevant when an attacker can influence the state of the resource between check and use. This can happen with shared resources such as files, memory, or even variables in multithreaded programs.","Incomplete","Base","Simple",false,[],{"title":90,"metaDescription":91,"keywords":92,"canonicalUrl":93,"structuredData":94},"What is CVE-2024-27297? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2024-27297, a medium severity cyber security vulnerability from 2024. Nix is a package manager for Linux and other Unix systems...","CVE-2024-27297, CVE-2024-27297 vulnerability, CVE-2024-27297 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2024, CVSS score, exploit, patch, remediation, nixos security, nix vulnerability","\u002Fwhat-is\u002Fcve-2024-27297",{"@context":95,"@type":96,"headline":90,"description":91,"datePublished":10,"dateModified":11,"author":97,"publisher":101,"about":105,"mainEntityOfPage":109,"articleSection":112,"keywords":113},"https:\u002F\u002Fschema.org","TechArticle",{"@type":98,"name":99,"url":100},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":98,"name":99,"url":100,"logo":102},{"@type":103,"url":104},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":106,"name":6,"description":107,"additionalType":108},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":110,"@id":111},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2024-27297","Cybersecurity","CVE-2024-27297, CVE-2024-27297 vulnerability, CVE-2024-27297 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[115],{"Operator":29,"Negate":29,"Nodes":116},[117],{"Operator":118,"Negate":87,"CPEMatch":119},"OR",[120,123,127,131],{"Vulnerable":4,"Criteria":50,"MatchCriteriaID":121,"VersionStartExcluding":29,"VersionStartIncluding":29,"VersionEndExcluding":122,"VersionEndIncluding":29},"47601C02-77F2-4F60-9077-298221CA12F5","2.3.18",{"Vulnerable":4,"Criteria":50,"MatchCriteriaID":124,"VersionStartExcluding":29,"VersionStartIncluding":125,"VersionEndExcluding":126,"VersionEndIncluding":29},"0BD193CF-30E0-4583-AA03-101B1488A973","2.4","2.18.2",{"Vulnerable":4,"Criteria":50,"MatchCriteriaID":128,"VersionStartExcluding":29,"VersionStartIncluding":129,"VersionEndExcluding":130,"VersionEndIncluding":29},"69B51F29-3651-4418-B41A-847576A31C5A","2.19.0","2.19.4",{"Vulnerable":4,"Criteria":50,"MatchCriteriaID":132,"VersionStartExcluding":29,"VersionStartIncluding":133,"VersionEndExcluding":134,"VersionEndIncluding":29},"2C2A184D-2C19-4A49-BF6A-44EC5C89C156","2.20.0","2.20.5",[],[],{"lastModified":11,"cacheTime":138,"version":139},1792269821018,"2.0",{"score":141,"band":44,"action":142,"scoredAt":143},41,"Plan remediation","2026-10-16T07:01:07.397334+00:00"]