PT-2026-36945 · Canonical+1 · Incus+1
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Incus (affected versions not specified)
Description
A nil-pointer dereference exists in the custom volume backup import subsystem. An authenticated user with access to the storage volume feature can cause the Incus daemon to crash by importing a crafted backup archive. The issue occurs because the daemon iterates over the
VolumeSnapshots slice in srcBackup.Config and dereferences elements without validating if they are initialized. An attacker can provide an index.yaml file containing explicit null array elements in the volume snapshots array, which the YAML unmarshaler converts into nil pointers. This triggers a crash in the CreateCustomVolumeFromBackup() function, leading to a denial of service on the node.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Incus
Red Os