CVE-2025-32438: Local Privilege Escalation Vulnerability in make-initrd-ng

Overview

In this blog post, we will delve into the critical vulnerability identified as CVE-2025-32438. This vulnerability is a local privilege escalation flaw that affects all users of NixOS, a popular Linux distribution, through make-initrd-ng, a tool used for copying binaries and their dependencies. This is particularly concerning because an attacker can exploit this vulnerability to potentially compromise a system or leak sensitive data. The vulnerability is crucial to understand and address because of its high severity score and the broad user base it affects.

Vulnerability Summary

CVE ID: CVE-2025-32438
Severity: High (8.8 CVSS Score)
Attack Vector: Local
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

NixOS | 24.11, 25.05 / unstable

How the Exploit Works

The vulnerability lies in the make-initrd-ng tool’s improper handling of permissions in its copying process. When the systemd.shutdownRamfs.enable setting is enabled (which is the default), a local user can create a program that will be executed by root during shutdown. If an attacker can manipulate this process, they can elevate their privileges to root level, which can lead to the potential compromise of the entire system or data leakage.

Conceptual Example Code

To illustrate, an attacker might create a malicious program as follows:

#!/bin/bash
echo "Malicious code here" > /path/to/executable
chmod +x /path/to/executable

In the context of a shutdown sequence, this could be inserted into the shutdown process:

#!/bin/bash
/path/to/executable
shutdown -h now

This would allow the malicious program to be executed with root privileges during the shutdown process.

Mitigation Guidance

Given the severity of this vulnerability, it is highly recommended to apply the patches released for NixOS 24.11 and 25.05 / unstable. If patching is not immediately feasible, as a temporary mitigation, users can set systemd.shutdownRamfs.enable = false to disable the vulnerable feature. Furthermore, deploying a well-configured Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can also help detect and block potential exploitation attempts.