CVE-2025-54288
published 2025-10-02CVE-2025-54288: Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any…
PriorityP336medium6.8CVSS 3.1
AVNACLPRHUINSCCHINAN
EPSS
0.33%
24.6th percentile
Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | lxd | >= 0 < 5.0.2-5+deb12u1 | 5.0.2-5+deb12u1 |
| canonical | lxd | >= 0 < 5.0.2+git20231211.1364ae4-9+deb13u1 | 5.0.2+git20231211.1364ae4-9+deb13u1 |
| canonical | lxd | >= 4.0.0 < 5.21.4 | 5.21.4 |
| canonical | lxd | >= 5.21 < 5.21.4 | 5.21.4 |
| canonical | lxd | >= 6.0 < 6.5 | 6.5 |
| canonical | lxd | >= 6.1 < 6.5 | 6.5 |
| debian | incus | < incus 6.0.5-1 (forky) | incus 6.0.5-1 (forky) |
| debian | lxd | < incus 6.0.5-1 (forky) | incus 6.0.5-1 (forky) |
| github.com | canonical_lxd | >= 0.0.0-20200331193331-03aab09f5b5c < 0.0.0-20250827065555-0494f5d47e41 | 0.0.0-20250827065555-0494f5d47e41 |
| github.com | canonical_lxd | >= 4.0 < 5.21.4 | 5.21.4 |
| github.com | canonical_lxd | >= 6.0 < 6.5 | 6.5 |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv5.1MEDIUM
vendor_debian5.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server in github.com/canonical/lxd
osv·2025-11-05
CVE-2025-54288 Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server in github.com/canonical/lxd
Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server in github.com/canonical/lxd
Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server in github.com/canonical/lxd
OSV
CVE-2025-54288: Information Spoofing in devLXD Server in Canonical LXD versions 4
osv·2025-10-02·CVSS 5.1
CVE-2025-54288 [MEDIUM] CVE-2025-54288: Information Spoofing in devLXD Server in Canonical LXD versions 4
Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.
OSV
Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server
osv·2025-10-02
CVE-2025-54288 [MEDIUM] Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server
Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server
### Impact
In LXD's devLXD server, the source container identification process uses process cmdline (command line) information, allowing attackers to impersonate other containers by spoofing process names.
The core issue lies in the findContainerForPID function in `lxd/api_devlxd.go`.
This function identifies senders through two steps as shown below:
1. cmdline-based identification: Check while tracing back through parent processes, and if it starts with `[lxc monitor]`, extract the project name and container name from that process name in the format projectName_containerName.
2. PID namespace-based identification: If not found in Step 1, check against all containers' PID namespaces.
https
GHSA
Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server
ghsa·2025-10-02
CVE-2025-54288 [MEDIUM] CWE-290 Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server
Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server
### Impact
In LXD's devLXD server, the source container identification process uses process cmdline (command line) information, allowing attackers to impersonate other containers by spoofing process names.
The core issue lies in the findContainerForPID function in `lxd/api_devlxd.go`.
This function identifies senders through two steps as shown below:
1. cmdline-based identification: Check while tracing back through parent processes, and if it starts with `[lxc monitor]`, extract the project name and container name from that process name in the format projectName_containerName.
2. PID namespace-based identification: If not found in Step 1, check against all containers' PID namespaces.
https
Debian
CVE-2025-54288: incus - Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on...
vendor_debian·2025·CVSS 5.1
CVE-2025-54288 [MEDIUM] CVE-2025-54288: incus - Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on...
Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.
Scope: local
forky: resolved (fixed in 6.0.5-1)
sid: resolved (fixed in 6.0.5-1)
trixie: resolved (fixed in 6.0.4-2+deb13u1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-02
Published