PT-2025-26862 · Incus · Incus

Obp-Anssi · Published 2025-04-10 · Updated 2025-08-09 · CVE-2025-52889

Positive Technologies (AI Summary)

CVSS v3.1

3.4

Low

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Incus versions 6.12 through 6.13

Description: Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, it generates nftables rules for local services, such as DHCP and DNS, that partially bypass security options security.mac filtering, security.ipv4 filtering, and security.ipv6 filtering. This can lead to DHCP pool exhaustion and opens the door for other attacks.

Recommendations: For versions 6.12 and 6.13, apply the patch available at commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214 to resolve the issue. As a temporary workaround, consider restricting the use of ACLs on devices connected to a bridge until the patch is applied.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2025-08084

CVE-2025-52889

GHSA-9Q7C-QMHM-JV86

GO-2025-3781

OPENSUSE-SU-2025:15317-1

OPENSUSE-SU-2025:15405-1

Affected Products

Incus

References · 76

• 🔥 https://github.com/lxc/incus/security/advisories/GHSA-9q7c-qmhm-jv86 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52889.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-52889 · Security Note
• https://osv.dev/vulnerability/GHSA-9q7c-qmhm-jv86 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-52889 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-52889 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15405-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-52889 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3781 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08084 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-52889 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15317-1 · Vendor Advisory
• https://github.com/lxc/incus · Note
• https://github.com/lxc/incus/commit/a7c33301738aede3c035063e973b1d885d9bac7c · Note
• https://github.com/lxc/incus/commit/2516fb19ad8428454cb4edfe70c0a5f0dc1da214 · Note