x/vulndb: potential Go vuln in github.com/lima-vm/lima: CVE-2023-32684

[GoVulnBot]

CVE-2023-32684 references github.com/lima-vm/lima, which may be a Go module.

Description:
Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to version 0.16.0, a virtual machine instance with a malicious disk image could read a single file on the host filesystem, even when no filesystem is mounted from the host. The official templates of Lima and the well-known third party products (Colima, Rancher Desktop, and Finch) are unlikely to be affected by this issue. To exploit this issue, the attacker has to embed the target file path (an absolute or a relative path from the instance directory) in a malicious disk image, as the qcow2 (or vmdk) backing file path string. As Lima refuses to run as the root, it is practically impossible for the attacker to read the entire host disk via /dev/rdiskN. Also, practically, the attacker cannot read at least the first 512 bytes (MBR) of the target file. The issue has been patched in Lima in version 0.16.0 by prohibiting using a backing file path in the VM base image.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-32684
• JSON: https://github.com/CVEProject/cvelist/tree/d38720ccbffed6a288d5b9f6c49f1b5b8246d845/2023/32xxx/CVE-2023-32684.json
• advisory: GHSA-f7qw-jj9c-rpq9
• fix: lima-vm/lima@01dbd4d
• web: https://github.com/lima-vm/lima/releases/tag/v0.16.0
• Imported by: https://pkg.go.dev/github.com/lima-vm/lima?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/lima-vm/lima
    packages:
      - package: lima
description: |
    Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to version 0.16.0, a virtual machine instance with a malicious disk image could read a single file on the host filesystem, even when no filesystem is mounted from the host. The official templates of Lima and the well-known third party products (Colima, Rancher Desktop, and Finch) are unlikely to be affected by this issue. To exploit this issue, the attacker has to embed the target file path (an absolute or a relative path from the instance directory) in a malicious disk image, as the qcow2 (or vmdk) backing file path string. As Lima refuses to run as the root, it is practically impossible for the attacker to read the entire host disk via `/dev/rdiskN`. Also, practically, the attacker cannot read at least the first 512 bytes (MBR) of the target file. The issue has been patched in Lima in version 0.16.0 by prohibiting using a backing file path in the VM base image.
cves:
  - CVE-2023-32684
references:
  - advisory: https://github.com/lima-vm/lima/security/advisories/GHSA-f7qw-jj9c-rpq9
  - fix: https://github.com/lima-vm/lima/commit/01dbd4d9cabe692afa4517be3995771f0ebb38a5
  - web: https://github.com/lima-vm/lima/releases/tag/v0.16.0

[gopherbot]

Change https://go.dev/cl/503837 mentions this issue: data/excluded: batch add 21 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606786 mentions this issue: data/reports: unexclude 20 reports (6)