{"id":"GHSA-3g2j-vm47-x4mj","aliases":["GO-2025-4121"],"status":"published","title":"LXD vulnerable to a local privilege escalation through custom storage volumes","description":"**Impact**\n\nThis affects any LXD user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access to the host as an unprivileged user.\n\nThe most common case for this would be systems using `lxd-user` with the less privileged lxd group to provide unprivileged users with an isolated restricted access to LXD. Such users may be able to create a custom storage volume with the necessary property (depending on kernel and filesystem support) and can then write a setuid binary from within the container which can be executed as an unprivileged user on the host to gain root privileges.\n\n**Patches**\n\nPatches for this issue are available: \n\n- LXD 6 series: https://github.com/canonical/lxd/pull/16904\n- LXD 5.21 LTS series: https://github.com/canonical/lxd/pull/16922\n- LXD 5.0 LTS series: https://github.com/canonical/lxd/pull/16923\n- LXD 4.0 LTS series: https://github.com/canonical/lxd/pull/16924 \n\nThe first commit changes the permissions for any new storage pool, the later commit adds a patch that applies it on startup to all existing storage pools.\n\nThese fixes are also available in the associated candidate snap channels for each LTS series:\n\n- 5.21/candidate (5.21.4-8a3cf61)\n- 5.0/candidate (5.0.5-5c60378)\n- 4.0/candidate (4.0.10-35a8127)\n\nWe will be preparing intermediate releases to the associated stable snap channels shortly.\n\n**Workarounds**\n\nPermissions can be manually restricted until a patched version of LXD is deployed.\n\nThis is done with:\n\n```\nsudo nsenter --mount=/run/snapd/ns/lxd.mnt -- chmod 0700 /var/snap/lxd/common/lxd/storage-pools/*/{custom*,virtual-machines*,images}\nsudo nsenter --mount=/run/snapd/ns/lxd.mnt -- chmod 0711 /var/snap/lxd/common/lxd/storage-pools/*/{containers*,buckets*}\n```\n\nThose are the same permissions which will be applied by the patched LXD for both new and existing storage pools.\n\n**References**\n\nThis was reported to Incus publicly on Github here: \n\n- https://github.com/lxc/incus/security/advisories/GHSA-56mx-8g9f-5crf\n- https://github.com/lxc/incus/issues/2641","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2025-11-13T23:01:44Z","modified":"2025-11-18T18:40:13Z","fixes":[{"ecosystem":"Go","package":"github.com/canonical/lxd","fixed_in":["0.0.0-20251110144034-698854d0164f"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/canonical/lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20251110144034-698854d0164f"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/canonical/lxd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20251110144034-698854d0164f"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/canonical/lxd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"references":[{"url":"https://github.com/canonical/lxd/security/advisories/GHSA-3g2j-vm47-x4mj","tags":["web","advisory"]},{"url":"https://github.com/lxc/incus/security/advisories/GHSA-56mx-8g9f-5crf","tags":["web"]},{"url":"https://github.com/lxc/incus/issues/2641","tags":["web"]},{"url":"https://github.com/canonical/lxd/pull/16904","tags":["web","fix"]},{"url":"https://github.com/canonical/lxd/pull/16922","tags":["web","fix"]},{"url":"https://github.com/canonical/lxd/pull/16923","tags":["web","fix"]},{"url":"https://github.com/canonical/lxd/pull/16924","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-3g2j-vm47-x4mj"},{"url":"https://github.com/canonical/lxd","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-3g2j-vm47-x4mj","title":"LXD vulnerable to a local privilege escalation through custom storage volumes","description":"**Impact**\n\nThis affects any LXD user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access to the host as an unprivileged user.\n\nThe most common case for this would be systems using `lxd-user` with the less privileged lxd group to provide unprivileged users with an isolated restricted access to LXD. Such users may be able to create a custom storage volume with the necessary property (depending on kernel and filesystem support) and can then write a setuid binary from within the container which can be executed as an unprivileged user on the host to gain root privileges.\n\n**Patches**\n\nPatches for this issue are available: \n\n- LXD 6 series: https://github.com/canonical/lxd/pull/16904\n- LXD 5.21 LTS series: https://github.com/canonical/lxd/pull/16922\n- LXD 5.0 LTS series: https://github.com/canonical/lxd/pull/16923\n- LXD 4.0 LTS series: https://github.com/canonical/lxd/pull/16924 \n\nThe first commit changes the permissions for any new storage pool, the later commit adds a patch that applies it on startup to all existing storage pools.\n\nThese fixes are also available in the associated candidate snap channels for each LTS series:\n\n- 5.21/candidate (5.21.4-8a3cf61)\n- 5.0/candidate (5.0.5-5c60378)\n- 4.0/candidate (4.0.10-35a8127)\n\nWe will be preparing intermediate releases to the associated stable snap channels shortly.\n\n**Workarounds**\n\nPermissions can be manually restricted until a patched version of LXD is deployed.\n\nThis is done with:\n\n```\nsudo nsenter --mount=/run/snapd/ns/lxd.mnt -- chmod 0700 /var/snap/lxd/common/lxd/storage-pools/*/{custom*,virtual-machines*,images}\nsudo nsenter --mount=/run/snapd/ns/lxd.mnt -- chmod 0711 /var/snap/lxd/common/lxd/storage-pools/*/{containers*,buckets*}\n```\n\nThose are the same permissions which will be applied by the patched LXD for both new and existing storage pools.\n\n**References**\n\nThis was reported to Incus publicly on Github here: \n\n- https://github.com/lxc/incus/security/advisories/GHSA-56mx-8g9f-5crf\n- https://github.com/lxc/incus/issues/2641","status":"published","published":"2025-11-13T23:01:44Z","modified":"2025-11-18T18:40:13Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:39:08.983925Z"}],"osv":[{"id":"GHSA-3g2j-vm47-x4mj","title":"LXD vulnerable to a local privilege escalation through custom storage volumes","description":"**Impact**\n\nThis affects any LXD user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access to the host as an unprivileged user.\n\nThe most common case for this would be systems using `lxd-user` with the less privileged lxd group to provide unprivileged users with an isolated restricted access to LXD. Such users may be able to create a custom storage volume with the necessary property (depending on kernel and filesystem support) and can then write a setuid binary from within the container which can be executed as an unprivileged user on the host to gain root privileges.\n\n**Patches**\n\nPatches for this issue are available: \n\n- LXD 6 series: https://github.com/canonical/lxd/pull/16904\n- LXD 5.21 LTS series: https://github.com/canonical/lxd/pull/16922\n- LXD 5.0 LTS series: https://github.com/canonical/lxd/pull/16923\n- LXD 4.0 LTS series: https://github.com/canonical/lxd/pull/16924 \n\nThe first commit changes the permissions for any new storage pool, the later commit adds a patch that applies it on startup to all existing storage pools.\n\nThese fixes are also available in the associated candidate snap channels for each LTS series:\n\n- 5.21/candidate (5.21.4-8a3cf61)\n- 5.0/candidate (5.0.5-5c60378)\n- 4.0/candidate (4.0.10-35a8127)\n\nWe will be preparing intermediate releases to the associated stable snap channels shortly.\n\n**Workarounds**\n\nPermissions can be manually restricted until a patched version of LXD is deployed.\n\nThis is done with:\n\n```\nsudo nsenter --mount=/run/snapd/ns/lxd.mnt -- chmod 0700 /var/snap/lxd/common/lxd/storage-pools/*/{custom*,virtual-machines*,images}\nsudo nsenter --mount=/run/snapd/ns/lxd.mnt -- chmod 0711 /var/snap/lxd/common/lxd/storage-pools/*/{containers*,buckets*}\n```\n\nThose are the same permissions which will be applied by the patched LXD for both new and existing storage pools.\n\n**References**\n\nThis was reported to Incus publicly on Github here: \n\n- https://github.com/lxc/incus/security/advisories/GHSA-56mx-8g9f-5crf\n- https://github.com/lxc/incus/issues/2641","status":"published","published":"2025-11-13T23:01:44Z","modified":"2025-11-18T18:40:12Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"GO-2025-4121","title":"LXD vulnerable to a local privilege escalation through custom storage volumes in lxd in github.com/canonical/lxd","description":"LXD vulnerable to a local privilege escalation through custom storage volumes in lxd in github.com/canonical/lxd","status":"published","published":"2025-11-18T15:44:15Z","modified":"2025-11-18T16:14:17.916056Z","updated_at":"2026-11-02T15:47:02.011123Z"}]}}