CVE-2021-3429: 
NixOS vulnerability analysis and mitigation

CVE-2021-3429 is a security vulnerability discovered in cloud-init, affecting systems configured through cloud-init when the 'Set Passwords' module is used. The vulnerability was disclosed in March 2021 and involves randomly generated passwords being logged in clear-text to a world-readable file (Red Hat Portal).

The vulnerability occurs when cloud-init generates random passwords for users. Prior to the fix, these passwords would be written to stderr, which in the default configuration would also be written to '/var/log/cloud-init-output.log'. This log file was world-readable, making the randomly-generated passwords accessible to any user with system access (GitHub Commit).

The vulnerability exposed randomly generated passwords to all users with access to the system through the world-readable log file '/var/log/cloud-init-output.log'. This could potentially allow unauthorized users to gain access to accounts with generated passwords (Red Hat Portal).

The issue was addressed by modifying the logging code to write passwords directly to /dev/console instead of stderr, and by changing the permissions of files created in log sink subprocesses to be only owner/group readable. The fix also ensures that if the adm group exists, the log files will be owned by it (GitHub Commit).