Executive brief
LXD, a system container and virtual machine manager, contains a vulnerability where security restrictions on certain digital certificates are not enforced when the system is configured in Public Key Infrastructure (PKI) mode. In this specific configuration, a user with a restricted certificate could bypass those limitations to gain full administrative access to the LXD server. This could allow an authorized but limited user to view or modify sensitive server configurations they should not be able to access.
Technical details
A privilege escalation vulnerability exists in LXD when operating in PKI mode (triggered by the presence of a server.ca file). When the configuration option core.trust_ca_certificates is set to false, LXD fails to honor restrictions applied to CA-signed client certificates in the trust store. This occurs because the authorization logic incorrectly grants full access to any certificate signed by the CA when PKI mode is active, regardless of the 'restricted' flag. An attacker with a valid but restricted CA-signed certificate can achieve full administrative access to the LXD daemon. The issue was addressed in version 0.0.0-20240403103450-0e7f2b5bf4d2.
Affected products
- canonical lxd < 0.0.0-20240403103450-0e7f2b5bf4d2
Timeline
- 2024-12-02: advisory: Original advisory published by Canonical
- 2024-12-06: other: NVD publication date
- 2024-12-09: other: GitHub Advisory Database publication date