Skip to content

nixVersions.nix_2_3: add knownVulnerabilities #420974

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alyssais merged 2 commits into from
Jun 30, 2025
Merged

nixVersions.nix_2_3: add knownVulnerabilities #420974

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8722ff7
release.nix: pass lib-tests to tarball
alyssais Jun 29, 2025
1666082
nixVersions.nix_2_3: add knownVulnerabilities
alyssais Jun 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion ci/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,9 @@ let

pkgs = import nixpkgs' {
inherit system;
config = { };
config = {
permittedInsecurePackages = [ "nix-2.3.18" ];
};
overlays = [ ];
};

Expand Down
13 changes: 10 additions & 3 deletions lib/tests/release.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,16 @@
# The pkgs used for dependencies for the testing itself
# Don't test properties of pkgs.lib, but rather the lib in the parent directory
system ? builtins.currentSystem,
pkgs ? import ../.. { inherit system; } // {
lib = throw "pkgs.lib accessed, but the lib tests should use nixpkgs' lib path directly!";
},
pkgs ?
import ../.. {
inherit system;
config = {
permittedInsecurePackages = [ "nix-2.3.18" ];
};
}
// {
lib = throw "pkgs.lib accessed, but the lib tests should use nixpkgs' lib path directly!";
},
# For testing someone may edit impure.nix to return cross pkgs, use `pkgsBuildBuild` directly so everything here works.
pkgsBB ? pkgs.pkgsBuildBuild,
nix ? pkgs-nixVersions.stable,
Expand Down
3 changes: 2 additions & 1 deletion pkgs/tools/package-management/nix/common-autoconf.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
inherit hash;
},
patches ? [ ],
knownVulnerabilities ? [ ],
maintainers ? [
lib.maintainers.lovesegfault
lib.maintainers.artturin
Expand Down Expand Up @@ -335,7 +336,7 @@ let
'';
homepage = "https://nixos.org/";
license = licenses.lgpl21Plus;
inherit maintainers teams;
inherit knownVulnerabilities maintainers teams;
platforms = platforms.unix;
outputsToInstall = [ "out" ] ++ optional enableDocumentation "man";
mainProgram = "nix";
Expand Down
9 changes: 9 additions & 0 deletions pkgs/tools/package-management/nix/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,6 +159,15 @@ lib.makeExtensible (
patch-monitorfdhup
];
self_attribute_name = "nix_2_3";
knownVulnerabilities = [
"CVE-2024-38531"
"CVE-2024-47174"
"CVE-2025-46415"
"CVE-2025-46416"
Copy link
Member

@sternenseemann sternenseemann Jul 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From my understanding, also later versions of nix are vulnerable to CVE-2025-46416 since abstract unix sockets can be created in the main network namespace. So we should add it to knownVulnerabilities for the other packages in nixVersions for consistency?!

Copy link
Contributor

@tomberek tomberek Jul 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That weakness about abstract domain sockets is still present, but not the vulnerability described in the CVE. Known exploit chains are fixed.

"CVE-2025-52991"
"CVE-2025-52992"
"CVE-2025-52993"
];
maintainers = with lib.maintainers; [ flokli ];
teams = [ ];
}).overrideAttrs
Expand Down
8 changes: 7 additions & 1 deletion pkgs/top-level/make-tarball.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,13 @@
officialRelease,
pkgs ? import nixpkgs.outPath { },
nix ? pkgs.nix,
lib-tests ? import ../../lib/tests/release.nix { inherit pkgs; },
lib-tests ? import ../../lib/tests/release.nix {
pkgs = import nixpkgs.outPath {
config = {
permittedInsecurePackages = [ "nix-2.3.18" ];
};
};
},
}:

pkgs.releaseTools.sourceTarball {
Expand Down
27 changes: 24 additions & 3 deletions pkgs/top-level/release.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,7 @@ let
id
isDerivation
optionals
recursiveUpdate
;

inherit (release-lib.lib.attrsets) unionOfDisjoint;
Expand All @@ -95,16 +96,36 @@ let
"aarch64"
] (arch: elem "${arch}-darwin" supportedSystems);

nonPackageJobs = {
tarball = import ./make-tarball.nix { inherit pkgs nixpkgs officialRelease; };
nonPackageJobs = rec {
tarball = import ./make-tarball.nix {
inherit
pkgs
lib-tests
nixpkgs
officialRelease
;
};

release-checks = import ./nixpkgs-basic-release-checks.nix {
inherit pkgs nixpkgs supportedSystems;
};

manual = pkgs.nixpkgs-manual.override { inherit nixpkgs; };
metrics = import ./metrics.nix { inherit pkgs nixpkgs; };
lib-tests = import ../../lib/tests/release.nix { inherit pkgs; };
lib-tests = import ../../lib/tests/release.nix {
pkgs = import nixpkgs (
recursiveUpdate
(recursiveUpdate {
inherit system;
config.allowUnsupportedSystem = true;
} nixpkgsArgs)
{
config.permittedInsecurePackages = nixpkgsArgs.config.permittedInsecurePackages or [ ] ++ [
"nix-2.3.18"
];
}
);
};
pkgs-lib-tests = import ../pkgs-lib/tests { inherit pkgs; };

darwin-tested =
Expand Down