Lima up to 0.15.x Disk Image /dev/rdiskN file access

Summaryinfo

A vulnerability classified as problematic was found in Lima up to 0.15.x. This vulnerability affects unknown code of the file /dev/rdiskN of the component Disk Image Handler. The manipulation results in file access. This vulnerability is cataloged as CVE-2023-32684. The attack must be initiated from a local position. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Lima up to 0.15.x. It has been classified as problematic. Affected is an unknown function of the file /dev/rdiskN of the component Disk Image Handler. The manipulation with an unknown input leads to a file access vulnerability. CWE is classifying the issue as CWE-552. The product makes files or directories accessible to unauthorized actors, even though they should not be. This is going to have an impact on confidentiality. CVE summarizes:

Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to version 0.16.0, a virtual machine instance with a malicious disk image could read a single file on the host filesystem, even when no filesystem is mounted from the host. The official templates of Lima and the well-known third party products (Colima, Rancher Desktop, and Finch) are unlikely to be affected by this issue. To exploit this issue, the attacker has to embed the target file path (an absolute or a relative path from the instance directory) in a malicious disk image, as the qcow2 (or vmdk) backing file path string. As Lima refuses to run as the root, it is practically impossible for the attacker to read the entire host disk via `/dev/rdiskN`. Also, practically, the attacker cannot read at least the first 512 bytes (MBR) of the target file. The issue has been patched in Lima in version 0.16.0 by prohibiting using a backing file path in the VM base image.

The weakness was shared 05/30/2023 as GHSA-f7qw-jj9c-rpq9. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2023-32684 since 05/11/2023. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1083.

Upgrading to version 0.16.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 01dbd4d9cabe692afa4517be3995771f0ebb38a5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Lima

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion