A critical file system vulnerability in LXC Incus enables an authenticated user to perform arbitrary file reads or writes on the host system with root privileges.

This vulnerability arises from insufficient validation of symbolic links within the metadata.yaml file of container images. An authenticated user can exploit this to manipulate files on the host, as the system fails to confine these operations correctly.

Successful exploitation grants an attacker the power to overwrite critical system binaries, inject malicious configuration files, or steal sensitive data from the host. This effectively breaks the security boundary between the container and the underlying host operating system. With a CVSS score of 9.9, this vulnerability poses a severe threat to the entire infrastructure managed by the affected software.

Immediate Action: Update LXC Incus to version 7.3.0 or later to patch the metadata handling logic.

Proactive Monitoring: Review system logs for unexpected file access patterns or modifications to sensitive directories occurring via the Incus metadata API.

Compensating Controls: Implement strict file system monitoring and integrity checks on the host to detect unauthorized modifications to system files.

Public Exploit Available: No

Given the potential for full host system compromise, upgrading to version 7.3.0 is mandatory. Security teams should ensure that all Incus installations are updated without delay to prevent unauthorized host file access.