CVE-2024-5742: 
NixOS vulnerability analysis and mitigation

A vulnerability was discovered in GNU Nano (CVE-2024-5742) that allows potential privilege escalation through an insecure temporary file handling mechanism. When Nano is killed while editing, it saves the buffer to an emergency file with the permissions of the running user, creating a window of opportunity for attackers to escalate privileges through a malicious symlink (Debian Security, Ubuntu Security).

The vulnerability occurs when Nano is killed while having a modified buffer. The editor saves this buffer to an emergency .save file and then applies chmod and chown commands to match the permissions and owner of the original file. This becomes exploitable when Nano is run as root and edits a user-owned file in a directory writable by that user, allowing a malicious user to replace the .save file with a malicious symlink to a root-owned file. The vulnerability has a CVSS 3.1 base score of 6.7 (Medium), with attack vector being Local, attack complexity High, and requiring Low privileges (Ubuntu Security, Red Hat Bugzilla).

The primary impact of this vulnerability is the potential for privilege escalation on multi-user systems. It particularly affects scenarios where an administrator might open a user's file (for example, to fix a broken config file) using root privileges. If the user has the ability to kill the Nano process run by root, they could exploit this vulnerability to gain elevated privileges (Red Hat Bugzilla).

The vulnerability requires specific conditions to be exploitable: Nano must be running as root, editing a user-owned file in a user-writable directory, and the malicious user must have the ability to kill the Nano process. One example scenario involves root being logged in over SSH to a low-privilege user machine where the user can interrupt the connection, such as by turning off the WiFi (Red Hat Bugzilla).

The vulnerability has been fixed in various distributions through security updates. The fix was implemented in Nano version 8.0 through commit 5e7a3c2e7e118c7f12d5dfda9f9140f638976aa2. Multiple vendors have released patched versions: Red Hat Enterprise Linux 8 (RHSA-2024:6986), Red Hat Enterprise Linux 9 (RHSA-2024:9430), Ubuntu 22.04 LTS (6.2-1ubuntu0.1), and Debian (various versions) (Red Hat Security, Ubuntu Security).