Is CVE-2024-6219 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-6219 being exploited in the wild.

How severe is CVE-2024-6219?

Low severity, with a CVSS score of 3.8, published 9 December 2024.

Which products and versions are affected?

Canonical LXD < 0.0.0-20240403103450-0e7f2b5bf4d2; github.com/canonical/lxd (Go) < 0.0.0-20240403103450-0e7f2b5bf4d2, SEMVER:introduced=0,fixed=0.0.0-20240403103450-0e7f2b5bf4d2.

Is there a fix for CVE-2024-6219?

Yes. github.com/canonical/lxd (Go): upgrade to 0.0.0-20240403103450-0e7f2b5bf4d2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-6219 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2024-6219?

Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-6219: Canonical LXD privilege escalation in PKI mode TLS certificates

Q: Which products and versions are affected?

Canonical LXD < 0.0.0-20240403103450-0e7f2b5bf4d2; github.com/canonical/lxd (Go) < 0.0.0-20240403103450-0e7f2b5bf4d2, SEMVER:introduced=0,fixed=0.0.0-20240403103450-0e7f2b5bf4d2.

Q: Is there a fix for CVE-2024-6219?

Yes. github.com/canonical/lxd (Go): upgrade to 0.0.0-20240403103450-0e7f2b5bf4d2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-6219 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2024-6219?

Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-6219 · Severity: low · CVSS 3.8 · Published 2024-12-09

LXD, a system container and virtual machine manager, contains a vulnerability where security restrictions on certain digital certificates are not enforced when the system is configured in Public Key Infrastructure (PKI) mode. In this specific configuration, a user with a restricted certificate could bypass those limitations to gain full administrative access to the LXD server. This could allow an authorized but limited user to view or modify sensitive server configurations they should not be able to access.

Technologies: Canonical LXD, github.com/canonical/lxd (Go). Vendors: Canonical, Go.

Quick answers

Is CVE-2024-6219 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-6219 being exploited in the wild.
How severe is CVE-2024-6219?: Low severity, with a CVSS score of 3.8, published 9 December 2024.
Which products and versions are affected?: Canonical LXD < 0.0.0-20240403103450-0e7f2b5bf4d2; github.com/canonical/lxd (Go) < 0.0.0-20240403103450-0e7f2b5bf4d2, SEMVER:introduced=0,fixed=0.0.0-20240403103450-0e7f2b5bf4d2.
Is there a fix for CVE-2024-6219?: Yes. github.com/canonical/lxd (Go): upgrade to 0.0.0-20240403103450-0e7f2b5bf4d2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-6219 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2024-6219?: Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/canonical/lxd (Go): upgrade to 0.0.0-20240403103450-0e7f2b5bf4d2 or later
```
go get github.com/canonical/lxd@v0.0.0-20240403103450-0e7f2b5bf4d2
```

Technical details

A privilege escalation vulnerability exists in LXD when operating in PKI mode (triggered by the presence of a server.ca file). When the configuration option core.trust_ca_certificates is set to false, LXD fails to honor restrictions applied to CA-signed client certificates in the trust store. This occurs because the authorization logic incorrectly grants full access to any certificate signed by the CA when PKI mode is active, regardless of the 'restricted' flag. An attacker with a valid but restricted CA-signed certificate can achieve full administrative access to the LXD daemon. The issue was addressed in version 0.0.0-20240403103450-0e7f2b5bf4d2.

Affected products

canonical lxd < 0.0.0-20240403103450-0e7f2b5bf4d2

Identifiers

CVE-2024-6219
GHSA-jpmc-7p9c-4rxf
GO-2024-3313

Timeline

2024-12-02: advisory: Original advisory published by Canonical
2024-12-06: other: NVD publication date
2024-12-09: other: GitHub Advisory Database publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.