Incus Project Isolation Restriction Bypass by Omitting security.idmap.isolated (CVE-2023-42313)

Vulnerability Overview Vulnerability Name: Project isolation restriction bypass by omitting Description: The restriction at the project level can be bypassed by omitting the configuration item, allowing users to create a non-isolated (shared host idmap) container. This restriction only explicitly rejects a set (or empty) and fails when the key is omitted. Since defaults to (non-isolated) when not set, users can obtain the desired container state simply by omitting the key, thereby bypassing the restriction. This results in the failure of tenant isolation guarantees: containers within the project share the host idmap instead of receiving unique, non-overlapping ranges, weakening the isolation boundaries in a multi-tenant environment. Scope of Impact Affected Versions: = v7.3.0 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: Low CVE ID: CVE-2023-42313 Remediation Fixed Versions: >= v7.3.0 POC Code Impact Denial of Service: Non-isolated containers share the host idmap with every other non-isolated container. The kernel calculates resource budgets for each real host idmap, and these budgets are shared among all containers. A single tenant can exhaust the budget for each resource, denying service to all other tenants sharing the idmap. Loss of Data Integrity and Confidentiality: When files from two containers can be mounted (e.g., shared storage pools, volumes attached to multiple instances, host bind mounts, backup/restore between instances), a process in one container can access files owned by another container, thereby reading other tenants' data (confidentiality) or creating/modifying files owned by other tenants (integrity). This also expands the attack surface because the shared mapped idmap affects every container, not just one of them.

Goal Reached Thanks to every supporter — we hit 100%!

Incus Project Isolation Restriction Bypass by Omitting security.idmap.isolated (CVE-2023-42313)

More from this source