Arbitrary Command Execution in Lima via Guest Agent Socket

Executive Summary

This vulnerability affects Lima instances running Linux virtual machines with the QEMU driver and the guest agent enabled. An arbitrary user inside the VM can access the guest agent socket located at /run/lima-guestagent.sock. This socket provides tunneling services, including access to privileged Unix sockets such as D-Bus, which allows the user to execute arbitrary commands with root privileges inside the VM.

The issue arises because the socket has incorrect default permissions, exposing it to users who should not have access. This vulnerability does not affect the host system or VMs using the vz driver, as the guest agent in vz uses vsocks instead of Unix sockets. The vulnerability was fixed in Lima version 2.1.3.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an arbitrary user within a QEMU virtual machine running Lima to escalate privileges to root inside the VM by exploiting the guest agent socket. This could lead to unauthorized access and control over privileged processes within the VM.

Such unauthorized privilege escalation and potential unauthorized access to sensitive data or system controls could negatively impact compliance with standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive information.

However, the vulnerability is limited to the VM environment and does not affect the host system. The issue was fixed in Lima version 2.1.3 by restricting socket access.

Useful 0 Not Useful 0

Impact Analysis

If you are running a Lima VM with the QEMU driver and the guest agent enabled, an arbitrary user inside the VM could escalate their privileges to root. This means they could execute any command with full administrative rights within the VM, potentially compromising the integrity, confidentiality, and availability of the VM environment.

This could lead to unauthorized access to sensitive data, modification or deletion of critical files, and disruption of services running inside the VM. However, this vulnerability does not affect the host system or VMs using the vz driver.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if a Lima VM is running with the QEMU driver and if the guest agent is enabled. Specifically, you should verify the presence and permissions of the socket file `/run/lima-guestagent.sock` inside the VM.

Commands to detect the vulnerability include inspecting the socket file permissions and ownership within the VM:

• Run `ls -l /run/lima-guestagent.sock` inside the VM to check if the socket exists and its permission settings.
• Check if the guest agent is enabled and running by inspecting the relevant systemd service or process inside the VM.
• Verify if the Lima VM is using the QEMU driver rather than the vz driver, as the vulnerability only affects QEMU.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Lima to version 2.1.3 or later, where the issue is fixed.

The fix involves restricting access to the guest agent socket by changing its ownership and permissions so that only the main user inside the VM can access it.

• Upgrade Lima to v2.1.3 or newer.
• Use the new `--socket-owner` command-line flag to specify the UID of the main user who should own the UNIX socket, ensuring the socket permissions are set to 0600.
• Disable the guest agent if it is not required.

Note that the vulnerability does not affect VMs using the vz driver or macOS hosts with the guest agent disabled.

Useful 0 Not Useful 0