CVE-2016-1581

What it actually does

Sets world-readable permissions on /var/lib/lxd/zfs.img for loop-based ZFS pools, enabling any local user to directly read or copy container filesystem contents.

Why it matters to the business

Local attackers on affected systems can exfiltrate data stored inside containers without elevated privileges, increasing risk of sensitive information exposure in environments using these packages.

How an attack unfolds

An attacker with local shell access identifies the world-readable zfs.img backing file, copies or mounts it to inspect container data, and extracts files or secrets from any containers using the ZFS pool.

How to fix it

Upgrade dynamic-localpv-provisioner (Chainguard) to 3.4.1-r3 or later and dynamic-localpv-provisioner (Wolfi) to 3.4.1-r3 or later; verify LXD is at least version 2.0.2 and ensure zfs.img permissions are restricted to root-only after upgrade.

How to confirm the fix worked

Confirm package versions match the fixed releases, check that /var/lib/lxd/zfs.img has 600 or stricter permissions, and test that non-root users cannot read the file.

Typical attack path

1. Obtain local user access on the host
2. Locate /var/lib/lxd/zfs.img with world-readable permissions
3. Copy or directly read the image file
4. Mount or parse the ZFS image to extract container contents

How to detect it

Search host logs and file access records for non-root processes or users reading /var/lib/lxd/zfs.img; inspect shell history or cron jobs that reference the path; review container data access patterns for unexpected reads.

• /var/lib/lxd/zfs.img
• world-readable permissions on zfs.img
• lxd zfs pool setup

What your security team should do

• Immediately upgrade affected packages to the listed fixed versions
• Audit container hosts for the world-readable zfs.img file and correct permissions
• Review local user accounts and restrict access to container hosts
• Monitor for any post-upgrade permission regressions in ZFS pool setup