Skip to content
Log inStart free trial

GHSA-56mx-8g9f-5crf CVE-2025-64507 GO-2025-4115

Incus vulnerable to local privilege escalation through custom storage volumes

High Go
Severity
0.0 / 10
High · CVSS 4.0
Exploit chance (EPSS)
0.18%
Chance of exploitation in the next 30 days. Higher than 7.38% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-269 Improper Privilege Management
Fix
6.19.0
Upgrade github.com/lxc/incus/v6 to this version or later

Description

Impact

This affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the security.shifted property set to true as well as access to the host as an unprivileged user.

The most common case for this would be systems using incus-user with the less privileged incus group to provide unprivileged users with an isolated restricted access to Incus. Such users may be able to create a custom storage volume with the necessary property (depending on kernel and filesystem support) and can then write a setuid binary from within the container which can be executed as an unpriivleged user on the host to gain root privileges.

Patches

A patch for this issue is available here: https://github.com/lxc/incus/pull/2642

The first commit changes the permissions for any new storage pool, the second commit applies it on startup to all existing storage pools.

Workarounds

Permissions can be manually restricted until a patched version of Incus is deployed.

This is done with:

chmod 0700 /var/lib/incus/storage-pools/*/*
chmod 0711 /var/lib/incus/storage-pools/*/buckets*
chmod 0711 /var/lib/incus/storage-pools/*/container*

Those are the same permissions which will be applied by the patched Incus for both new and existing storage pools.

References

This was reported publicly on Github by here: https://github.com/lxc/incus/issues/2641

Affected versions

Go

PackageVulnerableFixed in
github.com/lxc/incus
all versions
 No fix yet
github.com/lxc/incus/v6
< 6.19.0
6.19.0
github.com/lxc/incus/v6
>= 6.1.0
 No fix yet

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/lxc/incus/v6 Go → 6.19.0

go
go get github.com/lxc/incus/v6@v6.19.0 && go mod tidy

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector
Local
Attack complexity
Low
Attack requirements
None
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
High
Integrity (vulnerable system)
High
Availability (vulnerable system)
High
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

CVSS 3.1 7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector
Local
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-269: Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

How to prevent it
  • Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
  • Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system.
  • Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GO-2026-6319
Incus has a project restriction bypass in instance copy across projects
High Also affects github.com/lxc/incus
GHSA-64f3-v33m-w89f
Incus has a project restriction bypass for custom volume copy across projects
High Also affects github.com/lxc/incus
GO-2026-5806
Incus has an arbitrary file write on its client due to trusted image hash
Critical Also affects github.com/lxc/incus
GO-2026-5810
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)
Low Also affects github.com/lxc/incus
GO-2026-5808
Incus has an argument injection in backup compression algorithm leading to AFW and ACE
Critical Also affects github.com/lxc/incus
GO-2026-5800
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
Low Also affects github.com/lxc/incus
GO-2026-5802
Incus has an arbitrary file write via path traversal in S3 multipart upload
Critical Also affects github.com/lxc/incus
GO-2026-5803
Incus has arbitrary file read+write on host via templates/ symlink in malicious image
Critical Also affects github.com/lxc/incus
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor