Vulnerability · Published Dec 5, 2024 · Assigned by canonical
CVE-2024-6156
Low 3.8
In plain English
A low-severity improper certificate validation in LXD from Canonical Ltd.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.8Low
Exploit odds (30 days)0.2%top 94.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | incus | 6.0.3-1 | DEBIAN-CVE-2024-6156 |
| Debian:14 | incus | 6.0.3-1 | DEBIAN-CVE-2024-6156 |
| Debian:12 | lxd | no fix listed | DEBIAN-CVE-2024-6156 |
| Debian:13 | lxd | no fix listed | DEBIAN-CVE-2024-6156 |
| Go | github.com/canonical/lxd | 0.0.0-20240708073652-5a492a3f0036 | GHSA-4c49-9fpc-hc3v |
| Go | github.com/canonical/lxd | 0.0.0-20240708073652-5a492a3f0036 | GO-2024-3312 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Canonical Ltd. | LXD | 4.0 – before 4.0.104.0 – before 5.0.44.0 – before 5.21.24.0 – before 6.1 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
References
- https://github.com/canonical/lxd/security/advisories/GHSA-4c49-9fpc-hc3v issue-tracking
- https://www.cve.org/CVERecord?id=CVE-2024-6156 issue-tracking