CVE-2024-36050: 
Linux Debian vulnerability analysis and mitigation

Nix through version 2.22.1 contains a vulnerability in its hash cache handling mechanism. The vulnerability (CVE-2024-36050) was disclosed in May 2024 and affects the Nix package manager. This security flaw makes it easier for attackers to replace current source code with attacker-controlled source code by manipulating maintainers into accepting malicious pull requests (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. This indicates that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, but does require user interaction. The impact primarily affects integrity, with no direct impact on confidentiality or availability (NVD).

The vulnerability affects the integrity of source code management in Nix packages. When exploited, it allows attackers to potentially substitute legitimate source code with malicious code through the package manager's hash cache mechanism. This could lead to the distribution of compromised packages if maintainers are successfully deceived into accepting malicious changes (NVD).

The vulnerability requires user interaction, specifically requiring a maintainer to accept a malicious pull request. The attack vector is network-accessible, making it possible for remote attackers to attempt exploitation. As of current reports, there is no confirmation of this vulnerability being actively exploited in the wild (NVD).

Currently, all versions of Nix through 2.22.1 are considered vulnerable. The issue remains unfixed in several distributions including Debian's bullseye, bookworm, sid, and trixie releases (Debian Tracker). Users and maintainers should exercise additional caution when reviewing and accepting pull requests until a patch is available.

The vulnerability was initially discussed in the NixOS community forums as part of broader supply chain security concerns. The discovery has led to increased attention on Nixpkgs supply chain security, with the community actively working on improving security measures (NixOS Discourse).