GHSA-x9qq-236j-gj97 – github.com/canonical/lxd

Package

Manager: go
Name: github.com/canonical/lxd
Vulnerable Version: =5.19.0 || >=5.19.0 <5.20.0 || >=0.0.0-20230920084527-cbe39c5d3f14 <0.0.0-20240118092008-ce1bd0dd37bb

Severity

Level: Low

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L/E:U/RL:O/RC:C

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L

EPSS: N/A pctlN/A

Details

Canonical LXD documentation improvement to make clear restricted.devices.disk=allow without restricted.devices.disk.paths also allows shift=true ### Summary If a user has restricted access to a project that is configured with `restricted=true`, they can gain root access on the system by creating a disk device with `shift=true` and creating a setuid root executable. This is possible because the `shift` property is not restricted unless `restricted.devices.disk.paths` is set. ### Details The following patch shows the offending code with a possible fix: ```patch --- a/lxd/device/disk.go +++ b/lxd/device/disk.go @@ -429,17 +429,19 @@ func (d *disk) validateEnvironmentSourcePath() error { if instProject.Name != api.ProjectDefaultName { // If restricted disk paths are in force, then check the disk's source is allowed, and record the // allowed parent path for later user during device start up sequence. - if shared.IsTrue(instProject.Config["restricted"]) && instProject.Config["restricted.devices.disk.paths"] != "" { - allowed, restrictedParentSourcePath := project.CheckRestrictedDevicesDiskPaths(instProject.Config, d.config["source"]) - if !allowed { - return fmt.Errorf("Disk source path %q not allowed by project for disk %q", d.config["source"], d.name) + if shared.IsTrue(instProject.Config["restricted"]) { + if instProject.Config["restricted.devices.disk.paths"] != "" { + allowed, restrictedParentSourcePath := project.CheckRestrictedDevicesDiskPaths(instProject.Config, d.config["source"]) + if !allowed { + return fmt.Errorf("Disk source path %q not allowed by project for disk %q", d.config["source"], d.name) + } + + d.restrictedParentSourcePath = shared.HostPath(restrictedParentSourcePath) } if shared.IsTrue(d.config["shift"]) { return fmt.Errorf(`The "shift" property cannot be used with a restricted source path`) } - - d.restrictedParentSourcePath = shared.HostPath(restrictedParentSourcePath) } } ``` ### PoC ```bash $ lxc project create restricted -c restricted=true -c restricted.devices.disk=allow $ lxc project switch restricted $ lxc profile device add default root disk path=/ pool=default $ lxc init ubuntu:22.04 c1 $ lxc config device add c1 d1 disk source=/ path=/mnt shift=true $ lxc start c1 # no error $ lxc project set restricted restricted.devices.disk.paths=/ # explicitly allow mounting / $ lxc restart c1 Error: Failed to start device "d1": The "shift" property cannot be used with a restricted source path ``` Created https://github.com/canonical/lxd/issues/12606 to improve the documentation as per https://github.com/canonical/lxd/security/advisories/GHSA-x9qq-236j-gj97#advisory-comment-91918

Metadata

Created: 2023-12-05T23:32:58Z
Modified: 2025-07-22T14:57:33Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-x9qq-236j-gj97/GHSA-x9qq-236j-gj97.json
CWE IDs: []
Alternative ID: N/A
Finding: F159
Auto approve: 1