Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability has been identified in LXD, a system container manager, that allows an authenticated user to bypass security restrictions when migrating virtual instances between projects. This bypass occurs because the system treats internal cluster notifications differently, potentially allowing an attacker to introduce unauthorized configurations into protected projects. The main concern is confirming relevance and exposure within your LXD deployments.
- Bypass security to move unauthorized instances.
- Allows bypassing project restrictions on migrations.
- Confirm if your LXD environment is affected.
Attack Path
How an attacker could exploit the issue
An attacker with existing authenticated access can exploit this vulnerability to bypass security controls when migrating virtual instances between projects. By initiating a cross-project instance migration and targeting a specific cluster member, the attacker can trick the destination node into skipping its usual project restriction checks. This allows the attacker to introduce unauthorized instance configurations into projects that are meant to have strict limitations, potentially leading to a compromise of those projects.
- Authenticated access to the system is required.
- Cross-project instance migration triggers the bypass.
- Allows introduction of disallowed configurations.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an authenticated attacker to bypass project restrictions when migrating instances between projects on different cluster members. This occurs because the destination node treats the migration request as an internal cluster notification, skipping security checks. An attacker could leverage this to introduce disallowed instance configurations into a restricted project.
- Restricted project configurations could be compromised.
- Instances may be migrated with disallowed configurations.
- Project security policies could be circumvented.
Operational Fix
Recommended remediation, mitigation, and detection steps
This authorization bypass vulnerability in LXD impacts authenticated users and requires coordinated action between platform or infrastructure teams responsible for LXD and the security team overseeing project restrictions. The immediate first step is to identify all LXD clusters, confirm which projects are using cross-project migrations, and assess the business criticality of affected projects. Once identified, ownership of vulnerable instances and projects must be confirmed before planning remediation, potentially involving vendor coordination or temporary security configurations.
- Platform or infrastructure teams own remediation.
- Verify cross-project migration usage and target projects.
- Plan remediation based on project criticality and ownership.
