Importing a crafted backup leads to project restriction bypass

In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archive where backup.yaml carries restricted settings such as security.privileged=true or raw.lxc directives, bypassing all project restriction enforcement and allowing full host compromise.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

输入验证不恰当

LXD 安全漏洞

LXD是Canonical开源的一款基于Linux系统用于管理应用程序的容器。 LXD 6.8之前版本存在安全漏洞，该漏洞源于备份导入路径仅验证备份存档中的backup/index.yaml文件，而未对backup/container/backup.yaml文件进行项目限制检查，可能导致经过身份验证的远程攻击者绕过所有项目限制，完全控制主机。

N/A

N/A