GHSA-2j9v-p4xj-cjw2: High severity go/github.com/lima-vm/lima/v2 vulnerability
Impact On an instance of Lima running with qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled.
This could result in running an arbitrary command with the root privileges in the VM (not on the host), as lima-guestagent.sock provides the tunneling service for an arbitrary address, including a Unix socket address for privileged daemons like D-Bus.
This vulnerability is not exploitable on vz driver, as the guest agent uses vsocks instead of Unix sockets.
Patches Patched in Lima v2.1.3 (8a45892378d22f40505c31a38f786a07701b6d50)
> [!NOTE] > The default user account in the VM can still run an arbitrary command as the root via the guest agent socket. > This is not a vulnerability, as the user can already run an arbitrary command with sudo by design.
Workarounds - On macOS hosts, use vz driver instead of qemu (limactl create --vm-type=vz. Default since v1.0.) - Or, disable the guest agent (limactl create --plain)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/lima-vm/lima/v2to a version that resolves this vulnerability.Fixed in 2.1.3 - Upgrade
Upgrade
Limato a version that resolves this vulnerability.Fixed in 2.1.3Patch 8a45892378d22f40505c31a38f786a07701b6d50 - Configuration
On macOS hosts, create the Lima VM using the `vz` driver instead of `qemu` (e.g., run `limactl create --vm-type=vz`) because the guest agent socket issue is not exploitable on `vz`.
Lima (qemu driver) guest agent usage = vz driver - Configuration
Disable the guest agent when creating the Lima VM (e.g., use `limactl create --plain`) to mitigate guest-agent socket access (note: the default user account can still run arbitrary commands as root via the guest agent socket, but mitigation guidance is to disable it).
Lima guest agent guest agent enablement = disabled
Event History
Frequently Asked Questions
What is the severity of GHSA-2j9v-p4xj-cjw2?
The severity of GHSA-2j9v-p4xj-cjw2 is high, with a rating of 8.2.
What is the impact of GHSA-2j9v-p4xj-cjw2?
GHSA-2j9v-p4xj-cjw2 allows an arbitrary user in the VM to access a socket that could enable execution of commands with root privileges in the VM.
Who is affected by GHSA-2j9v-p4xj-cjw2?
Instances of Lima running with the qemu driver and where the guest agent is enabled are affected by GHSA-2j9v-p4xj-cjw2.
How do I fix GHSA-2j9v-p4xj-cjw2?
To fix GHSA-2j9v-p4xj-cjw2, ensure the guest agent is disabled or update your Lima instance to the latest version that addresses this vulnerability.
What versions of Lima are affected by GHSA-2j9v-p4xj-cjw2?
Specific versions of Lima prior to the patch addressing GHSA-2j9v-p4xj-cjw2 are affected, particularly those that enable the guest agent.