Summary
A path traversal vulnerability in the LXD btrfs storage driver allows an authenticated project client authorized to create instances to influence host filesystem paths. Crafted migration or optimized-backup metadata may let the client delete arbitrary files as root and, on btrfs-root hosts, place attacker-controlled content at arbitrary paths, potentially resulting in full host compromise.
Affected context
The issue occurs in Canonical LXD deployments using the btrfs storage driver on Linux. It requires a client to have permission to create instances within an LXD project and to reach a workflow that processes optimized btrfs backup metadata or migration headers. The risk is greatest when the host root filesystem uses btrfs, because attacker-controlled content may then be written to arbitrary host paths.
Exploit preconditions
- Attack surface: LXD instance creation, optimized btrfs backup import, or btrfs migration processing
- Required access: Authenticated LXD client access with permission to create instances in a project
- Trigger point: Processing a crafted subvolume path in backup metadata or a migration header
- Why exploitation is possible: Path components are insufficiently constrained, allowing traversal sequences to escape the intended storage directory and affect host paths with elevated privileges
Why this happens
The underlying flaw is improper validation and containment of attacker-influenced filesystem paths. The btrfs storage driver accepts subvolume path data from migration or backup-related metadata without reliably preventing traversal outside the expected storage root. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, because externally influenced path components can redirect privileged filesystem operations to unintended locations.
Potential impact
- Arbitrary host files could be deleted with root-level privileges
- Critical system files or service data could be damaged
- On btrfs-root hosts, attacker-controlled content could be placed at arbitrary host paths
- LXD services and hosted workloads could be disrupted
- The host could be fully compromised through malicious file placement or subsequent execution
General mitigation guidance
Mitigation generally focuses on enforcing strict path containment and reducing the authority of storage operations.
Common defensive patterns include:
- Canonicalizing candidate paths and verifying that they remain beneath an approved storage root
- Rejecting traversal components and absolute paths before filesystem operations
- Applying the same validation to backup metadata and migration inputs
- Treating migration sources and imported archives as untrusted
- Running storage-related operations with the minimum filesystem privileges required
- Restricting which clients and projects can create instances or initiate migrations
- Using filesystem, host, and service isolation to limit the consequences of path-validation failures
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis rules that identify filesystem operations using user-controlled or archive-controlled paths
- Code review checks for missing canonicalization, prefix-boundary validation, or rejection of absolute and traversal paths
- Tests that attempt to resolve paths outside the intended storage directory using backup and migration inputs
- Runtime monitoring for LXD processes deleting or creating files outside managed storage locations
- Policy enforcement that limits migration sources, project permissions, and privileged filesystem access
- Automated security review tools that flag path construction and archive extraction without containment checks
