Executive brief
A security vulnerability in Canonical LXD, a system container and virtual machine manager, allows one guest user to access data belonging to another. If a specific management feature is enabled, an untrusted guest can bypass security checks to mount, read, and modify storage volumes that should be private to other guests. This could lead to the theft or corruption of sensitive data in shared hosting or multi-tenant environments.
Technical details
A broken access control vulnerability exists in the devLXDInstancePatchHandler component of Canonical LXD when the 'security.devlxd.management.volumes' setting is enabled. While the DevLXD storage API typically enforces ownership checks on GET, PUT, and DELETE requests, the instance device-update path (PATCH) fails to verify volume ownership when attaching a new disk device. An attacker with a local guest identity can submit a crafted device PATCH request over /dev/lxd to attach a custom storage volume belonging to another guest within the same project. This allows the attacker to gain full read and write access to the victim's volume data. The issue is addressed in LXD version 6.9 by ensuring device resource ownership is validated against the caller's identity during the attachment process.
Affected products
- Canonical LXD >= 6.6, < 6.9
Timeline
- 2026-06-26: disclosed
- 2026-06-26: advisory
- 2026-06-26: patched: Fixed in LXD version 6.9