PT-2023-23959 · Lima · Lima

Akihirosuda · Published 2023-05-30 · Updated 2024-08-20 · CVE-2023-32684

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lima versions prior to 0.16.0

Description A virtual machine instance with a malicious disk image could read a single file on the host filesystem, even when no filesystem is mounted from the host. The attacker has to embed the target file path in a malicious disk image, as the qcow2 (or vmdk) backing file path string. Lima refuses to run as the root, making it practically impossible for the attacker to read the entire host disk via /dev/rdiskN. The attacker also cannot read at least the first 512 bytes (MBR) of the target file.

Recommendations For versions prior to 0.16.0, update to version 0.16.0 or later, which prohibits using a backing file path in the VM base image. As a temporary workaround, do not use an untrusted disk image.

Exploit

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2023-32684

GHSA-F7QW-JJ9C-RPQ9

GO-2023-1803

Affected Products

Lima

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32684.json · Exploit
• https://github.com/lima-vm/lima/commit/01dbd4d9cabe692afa4517be3995771f0ebb38a5 · Patch
• https://github.com/lima-vm/lima/security/advisories/GHSA-f7qw-jj9c-rpq9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32684 · Security Note
• https://osv.dev/vulnerability/GO-2023-1803 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32684 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f7qw-jj9c-rpq9 · Vendor Advisory
• https://github.com/lima-vm/lima/releases/tag/v0.16.0 · Note
• https://github.com/lima-vm/lima · Note
• https://t.me/cvenotify/51401 · Telegram Post