CVE-2025-64507
📋 TL;DR
This vulnerability in Incus allows unprivileged users with container root access and host access to escalate privileges to root on the host system. It affects environments using incus-user with the incus group for restricted access. Attackers can create a custom storage volume with specific properties and write a setuid binary to gain root privileges.
💻 Affected Systems
- Incus
📦 What is this software?
Incus by Linuxcontainers
Incus by Linuxcontainers
⚠️ Risk & Real-World Impact
Worst Case
Full root compromise of the host system, allowing complete control over all containers and host resources.
Likely Case
Privilege escalation from unprivileged user to root on the host in multi-user Incus environments.
If Mitigated
No impact if proper access controls prevent unprivileged users from creating custom storage volumes or accessing containers with root privileges.
🎯 Exploit Status
Requires specific configuration and multiple access levels (container root + host unprivileged user).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.6 and 6.19.0
Vendor Advisory: https://github.com/lxc/incus/security/advisories/GHSA-56mx-8g9f-5crf
Restart Required: Yes
Instructions:
1. Update Incus to version 6.0.6 or 6.19.0 using your package manager. 2. Restart Incus services. 3. Verify the update was successful.
🔧 Temporary Workarounds
Restrict storage volume permissions
linuxManually restrict permissions on custom storage volumes to prevent unprivileged users from creating volumes with security.shifted=true property.
# Review and modify storage volume permissions
# Check current permissions: incus storage volume list
# Restrict access as needed based on your environment
🧯 If You Can't Patch
- Remove or restrict incus group membership for unprivileged users
- Audit and remove custom storage volumes with security.shifted=true property
🔍 How to Verify
Check if Vulnerable:
Check Incus version and verify if using incus-user with incus group for unprivileged access.Check Version:
incus --versionVerify Fix Applied:
Verify Incus version is 6.0.6 or 6.19.0 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual storage volume creation by unprivileged users
- Setuid binary execution from custom storage volumes
Network Indicators:
- None - this is a local privilege escalation
SIEM Query:
Search for: 'incus storage volume create' events from non-privileged users OR 'security.shifted' property modifications