CVE-2026-34177: fallo crítico en Canonical lxd
VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf
Publicada el
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 0.6%
probabilidad de explotación
0.6%top 52% de las CVE
explotación observada
noninguna fuente lo reporta
Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparmor and raw.qemu.conf from the set of keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote attacker with can_edit permission on a VM instance in a restricted project can inject an AppArmor rule and a QEMU chardev configuration that bridges the LXD Unix socket into the guest VM, enabling privilege escalation to LXD cluster administrator and subsequently to host root.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Productos afectados
Canonical · lxdCVEs relacionadas — Canonical lxd
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-28384CRITICALAuthenticated RCE via unsanitized compression_algorithmEPSS 0.9%CVE-2026-34178CRITICALImporting a crafted backup leads to project restriction bypassEPSS 0.7%CVE-2026-34179CRITICALUpdate of type field in restricted TLS certificate allows privilege escalation to cluster adminEPSS 0.4%CVE-2026-12411HIGHBroken Access Control in Canonical LXD DevLXD APIEPSS 0.3%CVE-2026-28385MEDIUMSSRF via image import from URL allows internal network probing by authenticated usersEPSS 0.3%CVE-2026-3351LOWAuthorization Bypass in LXD GET /1.0/certificates EndpointEPSS 0.2%