A significant vulnerability in Canonical's LXD and MicroCloud allowed an attacker to log in as a trusted client without the private key This article explores microcloud allowed attacker. . If the impersonated account has elevated privileges, the attacker can obtain "root access to the host machine," as Canonical has confirmed.
LXD and MicroCloud enable remote clients to access their APIs via mutual TLS, where the client presents a certificate to verify its identity.
A client is considered trusted when its certificate is included in the server's trust store, a list of identities the server is prepared to accept. It listens only on a local socket unless an administrator enables the network API with the core.https_address setting. Canonical revealed that an attacker who can intercept and steal a member's public certificate during their cluster join can then gain unauthorized access to that member.
The CVE record, dated October 30, states that the vulnerability is not known to have been exploited, is not listed on CISA's Known Exploited Vulnerabilities, and no working exploit has been published. On a snap installation, run the following commands: ```bash sudo snap refresh lxd sudo snap refresh microcloud ``` Canonical has confirmed that the fixed LXD point releases are still rolling out from the candidate channel to the stable channel.
Since the attack necessitates network access to the API, reducing access limits the risk until updates are made.
