Back

A coordinated security release is now available

April 7, 2026 at 05:24 PM UTC Resolved after 20h 32m

Updates

Resolved

The issue was fully resolved yesterday, but we typically keep our upgrade warnings posted for extra time for extra visibility. Please subscribe to our status page to receive timely security advisories.

April 8, 2026 at 01:57 PM UTC
Monitoring

You can now run determinate-nixd upgrade --version v3.17.3, and the following assets have now been released with Determinate Nix v3.17.3:

 

  • The Determinate Nix Installer
  • Determinate.pkg
  • DeterminateSystems/determinate-nix-action@v3 and `DeterminateSystems/determinate-nix-action@v3.17.3
  • DeterminateSystems/flakehub-cache-action@v3 and DeterminateSystems/flakehub-cache-action@v3.17.3
  • nix-eval-jobs
  • NixOS ISOs with Determinate Nix
  • NixOS with Determinate Nix AMIs (across AWS, AWS GovCloud, AWS European Sovereign Cloud)

 

For further information, contact support@determinate.systems

April 7, 2026 at 07:53 PM UTC
Identified

The Determinate Nix v3.17.3 release is now rolling out to 100% of nix-installer-action users. The determinate-nix-action update is still pending.

April 7, 2026 at 06:43 PM UTC
Identified

The Determinate Nix v3.17.3 release is now rolling out to 60% of nix-installer-action users. The determinate-nix-action update is pending.

April 7, 2026 at 06:32 PM UTC
Identified

Determinate Nix v3.17.3 is now available and continuing through our release process.

 

You can get the updated Determinate Nix from the Determinate flake: https://github.com/DeterminateSystems/determinate/

 

Example: https://github.com/DeterminateSystems/determinate#installing-using-our-nix-flake

 

Updated GitHub Actions, ISOs, AMIs, and other resources are on their way.

April 7, 2026 at 06:01 PM UTC
Identified

=== Fix for GHSA-g3g9-5vj6-r3gj: root privilege escalation via the Nix daemon

 

This release contains a critical fix for a security vulnerability on Linux that allows any user that has access to the Nix daemon to obtain root privileges.
This vulnerability affects all versions of Determinate Nix prior to 3.17.3, and all versions of upstream Nix prior to 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.

 

All users are advised to upgrade immediately.

 

Many thanks to edef for reporting this issue and to Sergei Zimmerman for implementing the fix.

 

=== Impact

 

A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating Nix builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output contents.

 

In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files.

 

=== Fix

 

The issue is fixed in Determinate Nix 3.17.3. The temporary output copy is now created in a directory in the store that is inaccessible to other users.

 

This release also includes additional hardening to prevent communication and file descriptor smuggling between cooperating fixed-output-derivations via abstract Unix sockets. This hardening is effective on kernels ≥ 6.12 with the landlock LSM enabled. On older kernels, it is skipped. This mitigation is ineffective at preventing communication between fixed-output derivations and processes running outside the Nix sandbox.

 

=== Workarounds

 

Do not allow untrusted builds to be submitted to the Nix daemon (via the allowed-users setting or by making the /nix/var/nix/daemon-socket directory inaccessible to untrusted users).

 

=== References

 

 

Impact score: 9.0

 

For more details, see the upstream advisory: https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj

April 7, 2026 at 05:24 PM UTC