CVE-2025-64507
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-10

Last updated on: 2025-12-29

Assigner: GitHub, Inc.

Description
Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access to the host as an unprivileged user. The most common case for this would be systems using `incus-user` with the less privileged `incus` group to provide unprivileged users with an isolated restricted access to Incus. Such users may be able to create a custom storage volume with the necessary property (depending on kernel and filesystem support) and can then write a setuid binary from within the container which can be executed as an unprivileged user on the host to gain root privileges. A patch for this issue is expected in versions 6.0.6 and 6.19.0. As a workaround, permissions can be manually restricted until a patched version of Incus is deployed.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-10
Last Modified
2025-12-29
Generated
2026-06-16
AI Q&A
2025-11-11
EPSS Evaluated
2026-06-15
NVD
CVE-2025-64507
EUVD
EUVD-2025-50816
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
linuxcontainers incus to 6.0.6 (exc)
linuxcontainers incus From 6.1.0 (inc) to 6.19.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-NVD-CWE-noinfo
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects Incus versions prior to 6.0.6 and 6.19.0. It allows an unprivileged user who has root access inside a container with a custom storage volume set with the 'security.shifted' property to 'true' and also has unprivileged access to the host, to create a setuid binary inside the container. This binary can then be executed on the host as an unprivileged user to gain root privileges, effectively escalating their privileges on the host system.

Impact Analysis

This vulnerability can lead to privilege escalation where an unprivileged user inside a container can gain root privileges on the host system. This compromises the security of the host, potentially allowing unauthorized access, control over the host system, and the ability to perform malicious actions with root privileges.

Mitigation Strategies

Until a patched version of Incus (6.0.6 or 6.19.0) is deployed, manually restrict permissions related to custom storage volumes with the 'security.shifted' property set to true, especially for unprivileged users with access to containers and the host. This reduces the risk of unprivileged users creating setuid binaries that could escalate privileges.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64507. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart