| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/lima-vm/lima | all versions | |
| github.com/lima-vm/lima/v2 | < 2.1.3 | 2.1.3 |
On an instance of Lima running with qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled.
This could result in running an arbitrary command with the root privileges in the VM (not on the host), as lima-guestagent.sock provides the tunneling service for an arbitrary address, including a Unix socket address for privileged daemons like D-Bus.
This vulnerability is not exploitable on vz driver, as the guest agent uses vsocks instead of Unix sockets.
Patched in Lima v2.1.3 (8a45892378d22f40505c31a38f786a07701b6d50)
[!NOTE] The default user account in the VM can still run an arbitrary command as the root via the guest agent socket. This is not a vulnerability, as the user can already run an arbitrary command with
sudoby design.
vz driver instead of qemu (limactl create --vm-type=vz. Default since v1.0.)limactl create --plain)Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free