A maximum-severity flaw in Canonical LXD and MicroCloud permits client impersonation without private keys, leading to potential root access.
Read about affected versions and snap updates.
To pull off the spoofing, one would need network access to the system and the public certificate of a user the system already trusted, which is not secret. If the account the attacker managed to impersonate had elevated privileges, they could gain full administrator access to the host machine, according to Canonical.
Who is affected and what was fixed?
The issue affected specific versions of LXD, including 4.0.14, 5.0.10, 5.21.8, and 6.9, before their respective fixes were released. Canonical released fixes via software updates, including LXD versions 6.10.1, 5.21.9, 5.0.11, 4.0.15, and MicroCloud 3.4.1 and 2.1.5.
At the same time, the Incus project identified this same issue, releasing the fixed version 7.6.0.
Attack status and instructions
According to the authorities and Canonical's assessments, there is no public evidence that the problem has been used in real attacks so far.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Security flaw in barcode scanners allows entry into warehouse networks
↗
Users are urged to update their installations immediately using the relevant program update commands.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
