Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in the Incus client, a system for managing containers and virtual machines, could allow an attacker to execute arbitrary commands as root on the server. This issue arises when the client interacts with a malicious image server that provides a specially crafted header. While the vulnerability is critical, its potential impact is primarily within environments where the Incus client is directly exposed to untrusted image sources.
- A flaw allows unauthorized command execution.
- Critical vulnerability in container management software.
- Assess relevance to your managed environments.
Attack Path
How an attacker could exploit the issue
An attacker could trick a user running the Incus client into connecting to a specially crafted image server. This server would send back a malicious response, allowing the attacker to write files anywhere on the user's system, potentially leading to full control as the root user.
- Entry Condition: User connects to a malicious image server.
- Trigger Point: Client receives a crafted header.
- Resulting Risk: Arbitrary file write, leading to root code execution.
Live Threat
Current exploitation, exposure, and threat context
A vulnerability in the Incus client could allow an attacker to execute arbitrary commands as root on the server when a malicious image server responds with a specially crafted `Incus-Image-Hash` header. This could affect the integrity and availability of the server, as well as any data managed by Incus.
- Arbitrary file writes on the server.
- Malicious image server response.
- Root command execution on the server.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability in the Incus client impacts teams responsible for managing container and virtual machine infrastructure. The first step is to identify all Incus client instances, determine their exposure and criticality, and locate the accountable owner to initiate a risk-based remediation plan.
- Infrastructure or Platform teams should own the issue.
- Verify Incus client reachability and asset criticality.
- Plan remediation based on asset risk exposure.
