| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/canonical/lxd | ≥ 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250827065555-0494f5d47e41≥ 4.0, < 5.21.4≥ 6.0, < 6.5 | 0.0.0-20250827065555-0494f5d47e415.21.46.5 |
| lxd | ≥ 4.0.0, < 5.21.4≥ 6.1, < 6.5 | 5.21.46.5 |
In LXD's devLXD server, the source container identification process uses process cmdline (command line) information, allowing attackers to impersonate other containers by spoofing process names.
The core issue lies in the findContainerForPID function in lxd/api_devlxd.go.
This function identifies senders through two steps as shown below:
[lxc monitor], extract the project name and container name from that process name in the format projectName_containerName.Attackers can exploit Step 1 processing to impersonate arbitrary containers across projects by spoofing process names.
root@EEEE:~# curl --unix-socket /dev/lxd/sock http://lxd-host/1.0/meta-data
instance-id: 9f928574-2561-4eff-af82-a68e57d3c68b
local-hostname: EEEE
root@EEEE:~# bash -c "exec -a '[lxc monitor]' curl --unix-socket /dev/lxd/sock http://lxd-host/1.0/meta-data -x 'test-project_DDDD'"
instance-id: 1bb2f1c3-3ad2-4cd6-9965-67b14c3582cc
local-hostname: DDDD
This attack successfully obtains metadata (instance-id, local-hostname) of another container DDDD from within container EEEE.
This vulnerability allows attackers to perform the following actions:
Theft of other containers' metadata information Obtaining other containers' information via devLXD API's /1.0/meta-data endpoint: https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/devlxd.go#L295-L304
Obtaining other containers' configuration information via devLXD API's /1.0/config and /1.0/config/{key} endpoints: https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/devlxd.go#L175-L221
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeObtaining other containers' device information via devLXD API's /1.0/devices endpoint: https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/devlxd.go#L377-L395 Particularly in environments where multiple projects run containers on the same LXD host, inter-project information leakage may occur. The attack prerequisite is root privileges within any container.
While containers basically run in separate PID namespaces, based on investigation, the [lxc monitor] process runs in the same PID namespace as the LXD execution process. Therefore, the problem can be resolved by modifying the implementation to use cmdline information only when the PID namespace of the target process matches the PID namespace of the process running LXD.
| LXD Series | Status |
|---|---|
| 6 | Fixed in LXD 6.5 |
| 5.21 | Fixed in LXD 5.21.4 |
| 5.0 | Ignored - Not critical |
| 4.0 | Ignored - EOL and not critical |
Reported by GMO Flatt Security Inc.