Listen to this Post
CVE-2026-53657 is a high-severity privilege escalation vulnerability discovered in Lima, a tool that launches Linux virtual machines (typically on macOS) for running containerd. The vulnerability affects Lima instances running with the QEMU driver and stems from improper access controls on the guest agent socket file located at /run/lima-guestagent.sock. When the guest agent is enabled, this socket becomes accessible to any user within the VM, including unprivileged ones. The socket provides a tunneling service for arbitrary addresses, including Unix socket addresses for privileged daemons like D-Bus. An attacker with a low-privileged user account inside the VM can connect to this socket and tunnel commands to privileged system services, effectively executing arbitrary commands with root privileges.
The vulnerability is rooted in CWE-276 (Incorrect Default Permissions) and CWE-668 (Exposure of Resource to Wrong Sphere). It carries a CVSS v3.1 base score of 8.2 (HIGH) with the vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The attack vector is local, requires low attack complexity, and no user interaction. The scope is changed, meaning a successful exploit can impact resources beyond the vulnerable component. Notably, this vulnerability is not exploitable on the `vzdriver` (virtio-vsock) as that driver uses vsocks instead of Unix sockets. The issue was patched in Lima v2.1.3 with commit 8a45892378d22f40505c31a38f786a07701b6d50. As a workaround, users can switch to `vzdriver` (limactl create --vm-type=vz, default since v1.0) or use limactl create --plain. The default user account in the VM can still run arbitrary commands as root via the guest agent socket by design, as they already have `sudo` access—this is not considered a vulnerability.
DailyCVE Form:
Platform: Lima (QEMU driver)
Version: < 2.1.3
Vulnerability: Privilege Escalation
Severity: High (CVSS 8.2)
Date: 2026-07-10
Prediction: Patch released 2026-06-19
What Undercode Say:
Check Lima version limactl --version Check if guest agent socket is world-accessible ls -la /run/lima-guestagent.sock Attempt to connect to the socket (unprivileged user) nc -U /run/lima-guestagent.sock Example command to tunnel to D-Bus (privileged daemon) echo "..." | socat - UNIX-CONNECT:/run/lima-guestagent.sock
Exploit: (Educational Purposes!)
An attacker with a low-privileged account inside the VM can exploit this by connecting to the exposed `/run/lima-guestagent.sock` and using its arbitrary address tunneling to communicate with privileged Unix sockets like D-Bus. This allows execution of arbitrary commands with root privileges within the VM, effectively compromising the entire virtualized environment.
Protection:
Upgrade to Lima v2.1.3 or later immediately. If upgrade is not possible, switch to `vzdriver` (limactl create --vm-type=vz) or use the `–plain` mode. Restrict access to the VM to trusted users only.
Impact:
Full compromise of the Lima VM. Any local user within the VM can escalate to root, gaining administrative control over all containerized applications and system services running inside the VM. The host system remains unaffected.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
