High severity · published Apr 15, 2025
CVE-2025-32438
Local privilege escalation in make-initrd-ng
8.8
CVSS
0.2%
EPSS
No
On KEV
Description
make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable enabled (the default) a local user is able to create a program that will be executed by root during shutdown. Patches exist for NixOS 24.11 and 25.05 / unstable. As a workaround, set systemd.shutdownRamfs.enable = false;.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NI
nixpkgs · NixOS
< b17590193d8e5697000c23c66afcf11e1753734d; < fbf76bf72b161b9f4ab97704a8258776d5f3ffba · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-32438
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-32438
github.com
https://github.com/NixOS/nixpkgs/commit/b17590193d8e5697000c23c66afcf11e1753734d
github.com
https://github.com/NixOS/nixpkgs/commit/fbf76bf72b161b9f4ab97704a8258776d5f3ffba
github.com
https://github.com/NixOS/nixpkgs/security/advisories/GHSA-m7pq-h9p4-8rr4
More from nixpkgs
9.1
CVE-2026-25137
NixOs Odoo database and filestore publicly accessible with default odoo configuration
8.7
CVE-2026-23838
Tandoor Recipes module allows SQLite database to be externally accessible with the default settings
8.5
CVE-2026-61828
nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`
5.8
CVE-2026-25740
Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module
5.3
CVE-2025-64766
NixOS has hardcoded credentials in Onlyoffice module