CVE-2024-36050

Executive Summary

CVE-2024-36050 is a critical security vulnerability in the Nix package manager (versions through 2.22.1) that allows attackers to replace legitimate source code with malicious code by exploiting mishandled hash cache usage. The vulnerability enables an attacker to lure a maintainer into accepting a malicious pull request, effectively bypassing the integrity guarantees that Nix’s content-addressed model is designed to provide. This attack undermines the trust model of the Nix ecosystem, potentially leading to widespread supply chain compromise.

Supply Chain & Package Security

This vulnerability directly impacts the Nix package manager and its ecosystem, including NixOS, Nixpkgs, and any system relying on Nix for reproducible builds. Since Nix is used to build and distribute software, a successful attack could inject backdoors into downstream packages, affecting all users of compromised derivations. The attack vector is particularly insidious because it exploits the hash cache mechanism, which is fundamental to Nix’s security model.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official CVSS vector assigned) Threat Level: Critical (based on attack vector and potential impact)

While no CVSS vector is provided, the vulnerability’s characteristics suggest:

• Attack Vector (AV): Network (attacker submits malicious PR)
• Attack Complexity (AC): Low (requires luring maintainer)
• Privileges Required (PR): None (attacker needs no special access)
• User Interaction (UI): Required (maintainer must accept PR)
• Scope (S): Changed (compromised packages affect downstream)
• Confidentiality (C): High (attacker can inject arbitrary code)
• Integrity (I): High (source code replaced)
• Availability (A): High (malicious code can disrupt builds)

Deep Dive & Mechanics

The vulnerability resides in Nix’s hash cache handling. Nix uses content-addressed storage where each build output is identified by a cryptographic hash of its contents. The hash cache is used to speed up builds by caching previously computed hashes. However, Nix through version 2.22.1 mishandles certain edge cases in the hash cache, allowing an attacker to craft a malicious pull request that, when accepted, causes Nix to use a cached hash for attacker-controlled source code instead of the legitimate source.

Attack Flow:

1. Attacker identifies a popular Nix package with a maintainer who accepts pull requests.
2. Attacker submits a pull request that appears benign but contains subtle changes to the build process or source code.
3. The malicious PR exploits the hash cache mishandling to make Nix believe the attacker’s code has the same hash as the legitimate code.
4. Maintainer accepts the PR, triggering a build that uses the attacker’s code but with the cached hash of the original.
5. The resulting package is distributed as legitimate, but contains backdoors or malware.

Root Cause: The hash cache does not properly validate that the cached hash corresponds to the actual source content when certain conditions are met (e.g., when the cache is populated from an untrusted source or when cache entries are reused across different contexts).

Vulnerable vs. Patched Code

Vulnerable Code (Nix <= 2.22.1):

# Simplified representation of hash cache logic
let
  hashCache = builtins.hashFile "sha256" ./source;
in
  # Cache is used without verifying source integrity
  fetchurl {
    url = "https://example.com/source.tar.gz";
    sha256 = hashCache;
  }

Patched Code (Hypothetical fix):

# Patched version with source verification
let
  sourceHash = builtins.hashFile "sha256" ./source;
  verifiedHash = if builtins.pathExists ./source-hash then
    builtins.readFile ./source-hash
  else
    sourceHash;
in
  fetchurl {
    url = "https://example.com/source.tar.gz";
    sha256 = verifiedHash;
    # Additional verification step
    postFetch = ''
      if [ "$(sha256sum $out)" != "${verifiedHash}" ]; then
        echo "Hash mismatch detected!"
        exit 1
      fi
    '';
  }

Key Difference: The patched code adds explicit verification of the hash against the actual source content, preventing cache poisoning.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to a Nix-based project that accepts pull requests
• Understanding of the target’s build process
• Ability to craft a malicious PR that exploits hash cache mishandling

Exploitation Steps:

1. Reconnaissance: Identify a target Nix package with a maintainer who frequently accepts PRs.
2. Craft Malicious PR: Create a PR that modifies the source code or build script in a way that triggers the hash cache vulnerability. For example, add a file that changes the hash calculation but appears benign.
3. Social Engineering: Lure the maintainer into accepting the PR (e.g., by making it look like a critical bug fix or feature addition).
4. Trigger Build: Once accepted, the build system will use the attacker’s code but with the cached hash, resulting in a compromised package.
5. Exfiltrate: The compromised package can then be distributed to users, allowing the attacker to execute arbitrary code on their systems.

Example Malicious PR (Conceptual):

# In default.nix
{ stdenv, fetchurl }:

stdenv.mkDerivation {
  name = "example-1.0";
  src = fetchurl {
    url = "https://example.com/source.tar.gz";
    sha256 = "0000000000000000000000000000000000000000000000000000"; # Attacker-controlled hash
  };
  buildPhase = ''
    # Attacker's malicious code
    echo "Malicious code executed" > /tmp/backdoor
  '';
}

Blue Team (Defender)

Detection Steps:

1. Monitor Hash Cache: Regularly audit the hash cache for unexpected entries or mismatches.
2. Verify Source Integrity: Implement additional verification steps in build scripts to ensure source hashes match expected values.
3. Review PRs Carefully: Scrutinize all pull requests for changes that could affect hash calculations or cache behavior.
4. Use Signed Commits: Require maintainers to sign commits and verify signatures before accepting PRs.
5. Implement Honeypots: Create decoy packages with known hashes to detect cache poisoning attempts.

Lab Setup:

# Set up a vulnerable Nix environment
nix-shell -p nixVersions.nix_2_22_1

# Create a test package with hash cache vulnerability
mkdir -p /tmp/test-pkg
cd /tmp/test-pkg
cat > default.nix << 'EOF'
{ stdenv, fetchurl }:
stdenv.mkDerivation {
  name = "test-1.0";
  src = fetchurl {
    url = "https://example.com/source.tar.gz";
    sha256 = builtins.hashFile "sha256" ./source;
  };
}
EOF

# Simulate cache poisoning
echo "malicious" > source
nix-build

Indicators of Compromise (IOCs)

• File Hashes: Unexpected SHA256 hashes in Nix store paths
• Network Traffic: Unusual outbound connections from build processes
• Process Anomalies: nix-build or nix-env processes with unexpected arguments
• File System: Modified files in /nix/store with unexpected content
• Logs: Entries in Nix daemon logs showing hash cache mismatches
• PR Metadata: Pull requests with suspicious changes to hash-related code

Example IOC:

# Suspicious hash cache entry
/nix/store/abc123...-source
# Expected hash: 5d41402abc4b2a76b9719d911017c592
# Actual hash: 7d793037a0760186574b0282f2f435e7

Detection Engineering

YARA Rule

rule Nix_Hash_Cache_Poisoning {
  meta:
    description = "Detects potential hash cache poisoning in Nix packages"
    author = "Valters IT"
    date = "2024-05-01"
    reference = "CVE-2024-36050"
  strings:
    $hash_cache = "hashFile" nocase
    $fetchurl = "fetchurl" nocase
    $sha256 = "sha256" nocase
  condition:
    all of ($hash_cache, $fetchurl, $sha256) and
    #filesize < 10KB
}

Sigma Rule

title: Nix Hash Cache Poisoning Attempt
id: 8c5a2f3e-9b7d-4a1c-8e6f-2d3b4c5a6e7f
status: experimental
description: Detects attempts to exploit CVE-2024-36050 by monitoring Nix build processes
author: Valters IT
date: 2024-05-01
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/nix-build'
    CommandLine|contains: 'hashFile'
  condition: selection
falsepositives:
  - Legitimate Nix builds using hashFile
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
  msg:"CVE-2024-36050 - Nix Hash Cache Poisoning Attempt";
  flow:to_server,established;
  content:"fetchurl"; http_uri; nocase;
  content:"sha256"; http_uri; nocase;
  sid:1000001;
  rev:1;
  reference:cve,2024-36050;
  classtype:attempted-admin;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Nix: Update to a patched version once available (currently no patch exists).
2. Disable Hash Cache: Temporarily disable hash caching in Nix configuration:

   nix.extraOptions = ''
     hash-cache = false
   '';
   

3. Audit Existing Packages: Review all packages built with vulnerable Nix versions for signs of compromise.
4. Implement Additional Verification: Add manual hash verification steps in build scripts.

Long-term Mitigations:

1. Use Signed Hashes: Implement cryptographic signing of hash cache entries.
2. Enable Two-Factor Authentication: Require 2FA for maintainers accepting PRs.
3. Regular Security Audits: Conduct periodic reviews of Nix build processes.
4. Monitor for Updates: Subscribe to Nix security advisories for patch announcements.

Workaround:

# Force Nix to re-verify all hashes
nix-store --verify --check-contents

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2024-36050