CVE-2023-5536

What it actually does

Members of the lxd group can invoke LXD operations that mount the host filesystem into a container and chroot into it, resulting in an immediate root shell on the host without any password prompt.

Why it matters to the business

Any local account placed in the lxd group gains unrestricted root access, allowing complete takeover of the Ubuntu server and all data and services it hosts.

How an attack unfolds

An attacker who obtains or already possesses membership in the lxd group runs a short sequence of lxc commands that creates a privileged container, mounts the host root filesystem, and executes a shell inside that container, immediately yielding root on the host.

How to fix it

Remove untrusted accounts from the lxd group, enforce sudo password requirements for lxd-related commands via /etc/sudoers.d, or restrict LXD socket access to a smaller trusted set of users; apply any subsequent Ubuntu package updates that harden the default LXD configuration.

How to confirm the fix worked

Confirm that non-root users in the lxd group cannot obtain a root shell via lxc commands; verify that the LXD socket permissions and sudoers rules require authentication; re-run the original LP#1829071 reproduction steps after changes.

Typical attack path

1. Obtain or be granted membership in the lxd group
2. Run lxc init to create a privileged container
3. Configure the container to mount the host root filesystem
4. Start the container and execute a shell via lxc exec
5. Obtain root shell on the host

How to detect it

Review authentication logs and sudo logs for lxc invocations by non-root users; inspect shell history files and process creation events for sequences of lxc init, lxc config device add, and lxc exec commands that target the host root filesystem.

What your security team should do

• Audit current membership of the lxd group on all Ubuntu servers and remove unnecessary accounts immediately
• Add explicit sudo password requirements for lxd operations in sudoers configuration
• Monitor package updates from Canonical and apply any LXD hardening fixes as soon as they are released
• Prefer dedicated service accounts with minimal group memberships instead of adding operators to lxd