Learn more about LXD privilege escalation from our experts. Our LXD Support team is here to help you with your questions and concerns.

LXD Privilege Escalation | About

Did you know that a member of the local LXD group can escalate the privileges to root on the host OS?

This occurs regardless of whether the user has sudo rights or not. In fact, this vulnerability exists with the LXD snap package as well.

LXD is a root process that carries out actions for anyone with write access to the LXD UNIX socket. In fact, it does not try to match the privileges of the calling user. Several multiple methods can exploit this.

One way is to mount the host’s root filesystem into a container with the LXD API. This offers low-privilege user root access to the host filesystem.

LXD privilege escalation usually occurs when an attacker exploits a vulnerability or misconfiguration within the LXD software to get additional privileges. This allows them to carry out actions they are not authorized to do. With escalated privileges, an attacker can compromise the security and integrity of the host system or other containers running on the same host.

Our experts recommend following security best practices to prevent LXD privilege escalation:

• Keep the LXD installation up to date with the latest security patches and bug fixes.
• Apply necessary security measures to the host system where LXD is running.
• By default, LXD containers are isolated from the host system. However, it is still important to configure container profiles to restrict unnecessary capabilities, like the ability to mount filesystems or access sensitive resources.
• Ensure that we are using trusted and secure container images from reputable sources.
• Perform regular security audits and monitoring of the LXD environment.
• Use strong passwords or keys for LXD. Additionally, make sure only authorized users have access to manage and modify the LXD environment.

[Need assistance with a different issue? Our team is available 24/7.]

Conclusion

To conclude, our Support Techs introduced us to LXD privilege escalation and how attackers can misuse it to compromise security.