Horizon Alert
Summary of the vulnerability and why it matters
This advisory addresses a vulnerability in Incus, a system for managing containers and virtual machines. The issue allows dangerous configurations to bypass project restrictions when copying instances, potentially leading to unauthorized access or modification of sensitive system settings. The primary concern is to confirm if Incus is in use and if this specific copy operation is performed.
- Bypasses security checks during instance copying.
- Critical for systems managing sensitive configurations.
- Confirm Incus usage and copying operations.
Attack Path
How an attacker could exploit the issue
An attacker with limited access can exploit this vulnerability by leveraging the way Incus handles instance copying between projects. When an instance is copied, sensitive configuration settings from the original instance are merged after a project restriction check, effectively bypassing security policies of the target project. This allows an attacker to inject dangerous configurations into a new instance, potentially leading to elevated privileges and control over the system.
- Requires authenticated, limited access.
- Copying an instance across projects.
- Bypasses project security restrictions.
Live Threat
Current exploitation, exposure, and threat context
When an instance is copied between projects, sensitive configuration keys from the source instance could be merged after a project restriction check, potentially bypassing those restrictions and affecting the target project's security posture.
- Instance configurations could be altered.
- Copying instances between projects.
- Project security restrictions could be bypassed.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability in Incus, a system container and virtual machine manager, allows for the bypassing of project restrictions when copying instances across projects. The issue arises from a check that occurs before the source instance's configuration is merged, enabling dangerous configuration keys to be introduced into a new project without proper authorization. Technical leaders and system owners should prioritize identifying all Incus deployments, determining their business criticality and network exposure, and coordinating with platform or infrastructure teams to plan remediation.
- Platform or infrastructure teams own this.
- Verify affected instances and their criticality.
- Plan remediation with vendor coordination.
