CVE-2025-54288: Github.com/canonical/lxd Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7232-97c6-j525",
  "modified" : "2025-11-05T22:04:46Z",
  "published" : "2025-10-02T21:20:25Z",
  "aliases" : [ "CVE-2025-54288" ],
  "summary" : "Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server",
  "details" : "### Impact\nIn LXD's devLXD server, the source container identification process uses process cmdline (command line) information, allowing attackers to impersonate other containers by spoofing process names.\n\nThe core issue lies in the findContainerForPID function in `lxd/api_devlxd.go`. \nThis function identifies senders through two steps as shown below:\n\n1. cmdline-based identification: Check while tracing back through parent processes, and if it starts with `[lxc monitor]`, extract the project name and container name from that process name in the format projectName_containerName.\n2. PID namespace-based identification: If not found in Step 1, check against all containers' PID namespaces.\n\nhttps://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/api_devlxd.go#L166-L276\n\nAttackers can exploit Step 1 processing to impersonate arbitrary containers across projects by spoofing process names.\n\n### Reproduction Steps\n1. Access devLXD server from a normal container (e.g., EEEE):\n\n```\nroot@EEEE:~# curl --unix-socket /dev/lxd/sock http://lxd-host/1.0/meta-data\ninstance-id: 9f928574-2561-4eff-af82-a68e57d3c68b\nlocal-hostname: EEEE\n```\n\n2. Use exec -a to spoof process name and impersonate another container (DDDD):\n\n```\nroot@EEEE:~# bash -c \"exec -a '[lxc monitor]' curl --unix-socket /dev/lxd/sock http://lxd-host/1.0/meta-data -x 'test-project_DDDD'\"\ninstance-id: 1bb2f1c3-3ad2-4cd6-9965-67b14c3582cc\nlocal-hostname: DDDD\n```\n\nThis attack successfully obtains metadata (instance-id, local-hostname) of another container\nDDDD from within container EEEE.\n\n### Risk\nThis vulnerability allows attackers to perform the following actions:\n\n1. Theft of other containers' metadata information\nObtaining other containers' information via devLXD API's /1.0/meta-data endpoint:\nhttps://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/devlxd.go#L295-L304\n\n2. Obtaining other containers' configuration information via devLXD API's /1.0/config and /1.0/config/{key} endpoints:\nhttps://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/devlxd.go#L175-L221\nhttps://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/devlxd.go#L228-L267\n\n4. Obtaining other containers' device information via devLXD API's /1.0/devices endpoint:\nhttps://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/devlxd.go#L377-L395\nParticularly in environments where multiple projects run containers on the same LXD host,\ninter-project information leakage may occur. The attack prerequisite is root privileges within\nany container.\n\n### Countermeasures\nWhile containers basically run in separate PID namespaces, based on investigation, the `[lxc monitor]` process runs in the same PID namespace as the LXD execution process. Therefore, the problem can be resolved by modifying the implementation to use cmdline information only when the PID namespace of the target process matches the PID namespace of the process running LXD.\n\n### Patches\n\n| LXD Series  | Status |\n| ------------- | ------------- |\n| 6 | Fixed in LXD 6.5  |\n| 5.21 | Fixed in LXD 5.21.4  |\n| 5.0 | Ignored - Not critical  |\n| 4.0  | Ignored - EOL and not critical |\n\n### References\nReported by  GMO Flatt Security Inc.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/canonical/lxd"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0"
      }, {
        "fixed" : "5.21.4"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/canonical/lxd"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.0"
      }, {
        "fixed" : "6.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/canonical/lxd"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.0.0-20200331193331-03aab09f5b5c"
      }, {
        "fixed" : "0.0.0-20250827065555-0494f5d47e41"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/canonical/lxd/security/advisories/GHSA-7232-97c6-j525"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-54288"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/canonical/lxd"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2025-4001"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-290" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-10-02T21:20:25Z",
    "nvd_published_at" : "2025-10-02T10:15:38Z"
  }
}