Description

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-12T20:17:47.713Z",
  "pubdate": "2026-08-12T20:17:47.713Z",
  "executiveSummary": "An improper neutralization of special elements vulnerability has been identified in LXD's handling of NVIDIA instance configurations. This security flaw allows an authenticated attacker to inject arbitrary configuration directives by supplying newline characters within specific configuration parameters. The primary impact of this vulnerability is complete host system compromise, enabling the attacker to execute arbitrary code with the elevated privileges of the LXD daemon. The affected product is LXD, specifically within its NVIDIA instance configuration handling component. Risk implications are severe, as a successful exploit bridges the container boundary and compromises the underlying host infrastructure. Attacker capabilities require prior authentication to the system with permissions to configure LXD instances. Exploitation requirements necessitate the manipulation of specific input fields, namely 'nvidia.driver.capabilities' or 'nvidia.require.*', to inject newline characters that alter the structure of the generated lxc.conf file. Remediation requires applying official patches provided by the vendor to properly sanitize input and prevent configuration injection.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and improper neutralization of special elements, specifically newline characters, within LXD's processing of NVIDIA instance configurations. The vulnerable component is responsible for parsing and writing out configuration directives to the generated lxc.conf file for container instances. When an authenticated attacker supplies manipulated values containing newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration parameters, the validation logic fails to strip or escape these control characters.\nDuring the configuration generation phase, LXD appends the attacker-supplied parameter values directly into the underlying lxc.conf file without adequate sanitization. Because the file format relies on newline-delimited directives, the injected newline characters allow the attacker to terminate the intended configuration context and introduce arbitrary, unintended lxc.conf directives. This manipulation grants the attacker the ability to define unauthorized container runtime behaviors, such as mounting host directories, exposing sensitive devices, or altering namespace configurations.\nThe attack flow proceeds as follows: First, the authenticated attacker gains access to configure an LXD instance. Second, the attacker crafts a malicious input string containing newline characters embedded within the 'nvidia.driver.capabilities' or 'nvidia.require.*' keys. Third, the attacker applies this configuration to the LXD instance. Fourth, LXD processes the input and writes the corrupted data directly into the generated lxc.conf file. Finally, when the container instance initializes or restarts, the LXC runtime parses the injected directives with the privileges of the LXD daemon, leading to arbitrary code execution on the host system.\nThe prerequisites for this attack include authenticated access to the LXD environment and the ability to modify instance configuration profiles or properties. Network exposure is local to the LXD socket or API endpoint depending on the daemon configuration. The post-exploitation impact includes full system compromise of the host operating system, unauthorized access to host resources, and potential lateral movement within the network due to the execution of arbitrary code under the privileges of the LXD daemon."
}