Septem9Er

**Name of the Vulnerable Software and Affected Versions** calamares-nixos-extensions versions prior to 0.3.17 **Description** The issue affects users who installed NixOS through the graphical installer using manual disk partitioning, where the system boots via legacy BIOS, some disk partitions are encrypted, but the partitions containing `/` or `/boot` are unencrypted. The LUKS disk encryption key file is stored in plain text in `/crypto keyfile.bin` or in a CPIO archive attached to the NixOS initrd. This problem is a partial regression of a previous issue and affects the security of the system. The estimated number of potentially affected devices is not specified. **Recommendations** For calamares-nixos-extensions versions prior to 0.3.17, the best solution is to back up data and perform a complete reinstallation. As a temporary workaround, consider deleting the `/crypto keyfile.bin` file and following the remediation steps for the previous advisory, especially if `/` is unencrypted but `/boot` is not. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the `crypto keyfile.bin` file in the affected setup until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** calamares-nixos-extensions versions 0.3.12 and prior **Description** The issue affects users of calamares-nixos-extensions who installed NixOS through the graphical calamares installer with an unencrypted `/boot`, on either non-UEFI systems or with a LUKS partition different from `/`. In these cases, the LUKS key file is stored in `/boot` as a plaintext CPIO archive attached to the NixOS initrd. A patch is anticipated to be part of version 0.3.13. **Recommendations** For versions 0.3.12 and prior, expert users can re-encrypt the LUKS partition(s) themselves as a workaround. Update to version 0.3.13 or later when available to apply the patch.