CVE-2024-43378

calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users who installed NixOS through the graphical installer who used manual disk partitioning to create a setup where the system was booted via legacy BIOS rather than UEFI; some disk partitions are encrypted; but the partitions containing either `/` or `/boot` are unencrypted; have their LUKS disk encryption key file in plain text either in `/crypto_keyfile.bin`, or in a CPIO archive attached to their NixOS initrd. `nixos-install` is not affected, nor are UEFI installations, nor was the default automatic partitioning configuration on legacy BIOS systems. The problem has been fixed in calamares-nixos-extensions 0.3.17, which was included in NixOS. The current installer images for the NixOS 24.05 and unstable (24.11) channels are unaffected. The fix reached 24.05 at 2024-08-13 20:06:59 UTC, and unstable at 2024-08-15 09:00:20 UTC. Installer images downloaded before those times may be vulnerable. The best solution for affected users is probably to back up their data and do a complete reinstallation. However, the mitigation procedure in GHSA-3rvf-24q2-24ww should work solely for the case where `/` is encrypted but `/boot` is not. If `/` is unencrypted, then the `/crypto_keyfile.bin` file will need to be deleted in addition to the remediation steps in the previous advisory. This issue is a partial regression of CVE-2023-36476 / GHSA-3rvf-24q2-24ww, which was more severe as it applied to the default configuration on BIOS systems.

• CWE-256

• https://github.com/NixOS/calamares-nixos-extensions/pull/43
• https://github.com/NixOS/calamares-nixos-extensions/security/advisories/GHSA-3rvf-24q2-24ww
• https://github.com/NixOS/calamares-nixos-extensions/security/advisories/GHSA-vfxf-gpmj-2p25
• https://github.com/NixOS/nixpkgs/pull/331607
• https://github.com/NixOS/nixpkgs/pull/334252

Published

Aug 16, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43371CKAN is an open-source data management system for powering d…6.5
• CVE-2024-43372Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-43373webcrack is a tool for reverse engineering javascript. An ar…7.8
• CVE-2024-43374The UNIX editor Vim prior to version 9.1.0678 has a use-afte…4.7
• CVE-2024-43376Umbraco is an ASP.NET CMS. Some endpoints in the Management …5.3
• CVE-2024-43377Umbraco CMS is an ASP.NET CMS. An authenticated user can acc…4.3
• CVE-2024-43379TruffleHog is a secrets scanning tool. Prior to v3.81.9, thi…3.1
• CVE-2024-43380fugit contains time tools for flor and the floraison group. …7.5
• CVE-2024-43381reNgine is an automated reconnaissance framework for web app…5.4
• CVE-2024-43382Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have a…5.9
• CVE-2024-43383Deserialization of Untrusted Data vulnerability in Apache Lu…8.1
• CVE-2024-43384A low privileged remote attacker can gain the root password …8