CVE-2024-6156: lxd CA certificate sign check bypass
(updated )
If a server.ca file is present in LXD_DIR at LXD start up, LXD is in “PKI mode”. In this mode, only TLS clients that have a CA-signed certificate should be able to authenticate with LXD.
We have discovered that if a client that sends a non-CA signed certificate during the TLS handshake, that client is able to authenticate with LXD if their certificate is present in the trust store.
- The LXD Go client (and by extension
lxc) does not send non-CA signed certificates during the handshake. - A manual client (e.g.
cURL) might send a non-CA signed certificate during the handshake.
References
- github.com/advisories/GHSA-4c49-9fpc-hc3v
- github.com/canonical/lxd
- github.com/canonical/lxd/commit/92468bb60f4f1edf38ff0434414bea4f28afa711
- github.com/canonical/lxd/security/advisories/GHSA-4c49-9fpc-hc3v
- nvd.nist.gov/vuln/detail/CVE-2024-6156
- pkg.go.dev/vuln/GO-2024-3312
- www.cve.org/CVERecord?id=CVE-2024-6156
Code Behaviors & Features
Detect and mitigate CVE-2024-6156 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →