CVE-2025-32438: nixos nixpkgs
Vulnerability summary
CVE-2025-32438 is a high (CVSS 8.8) vulnerability in nixos nixpkgs. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 7.7% of scored vulnerabilities.
Timeline
- 15-04-2025PublishedVulnerability first disclosed.
- 15-04-2025Last modifiedVulnerability information updated.
Description
make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable enabled (the default) a local user is able to create a program that will be executed by root during shutdown. Patches exist for NixOS 24.11 and 25.05 / unstable. As a workaround, set systemd.shutdownRamfs.enable = false;.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
0.00 pp
From 0.19% on 22-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-378Creation of Temporary File With Insecure PermissionsOpening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
- CWE-379Creation of Temporary File in Directory with Insecure PermissionsThe product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
Affected systems
Nixos1 product
- nixpkgs< b17590193d8e5697000c23c66afcf11e1753734d | < fbf76bf72b161b9f4ab97704a8258776d5f3ffba
1 vendor · 1 product
References
3 links- github.com/NixOS/nixpkgs/security/advisories/GHSA-m7pq-h9p4-8rr4X Refsource CONFIRM