-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a local privilege escalation in Incus caused by overly permissive directory permissions on storage pools, particularly affecting custom storage volumes. The analysis of the provided patches pinpoints the root cause and the functions involved.
The first commit, b0c6c0bac42c6ac27d536984cc043a6ec02b9e7c, reveals the core of the vulnerability. The function backend.createStorageStructure in internal/server/storage/backend.go was creating storage directories with a hardcoded 0o711 permission. This mode is too permissive for custom volumes, allowing unprivileged users on the host to traverse the directory and execute files, leading to privilege escalation if a setuid binary is present. The patch modifies this function to use specific modes for each volume type, tightening security by applying 0o700 to custom volumes.
The second commit, 3abdc12cf6a8dce391d28d340a32c137125357dd, introduces a new function, patchDefaultStoragePermissions, in cmd/incusd/patches.go. This function runs at startup to recursively apply the correct permissions to all existing storage pools. This serves as a mitigation for systems that already have storage pools with the incorrect permissions. The existence of this patch function confirms that the vulnerability was in the initial creation of the directories.
Therefore, backend.createStorageStructure is the primary vulnerable function, as it is executed when a new storage volume is created, which is the action that triggers the vulnerable condition. The patchDefaultStoragePermissions function is a key part of the fix and indicates that the vulnerability was actively being corrected in existing deployments.
backend.createStorageStructureinternal/server/storage/backend.go
patchDefaultStoragePermissionscmd/incusd/patches.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/lxc/incus/v6 | go | >= 6.1.0, <= 6.18.0 | |
| github.com/lxc/incus/v6 | go | <= 6.0.6 | |
| github.com/lxc/incus | go | <= 0.7.0 |
GoGoOngoing coverage of React2Shell