Nix and Lix disclose security flaws allowing local root access

The Nix and Lix projects have disclosed several security vulnerabilities that could allow local users to escalate privileges to root on affected systems. The flaws involve the background daemons used by these package managers to build software on behalf of users.

A critical issue allows unprivileged users to corrupt files in the Nix store through repair requests, which can lead to root access. This occurs because the daemon may unpack archives into the store before verifying their hashes. Other identified issues include an integer overflow in inbuiltins.genList, macOS sandbox escapes, and improper file ownership in certain multi-user installations.

Additionally, a specific vulnerability was identified in Nixpkgs involving Zellij. Due to an error in how makeBinaryWrapper and makeCWrapper handle the PATH variable, an empty entry can be created. This allows a user to execute arbitrary code if they place a malicious file in the current working directory of a repository being used with the affected Zellij build.