Impact On an instance of Lima running with qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled.

This could result in running an arbitrary command with the root privileges in the VM (not on the host), as lima-guestagent.sock provides the tunneling service for an arbitrary address, including a Unix socket address for privileged daemons like D-Bus.

This vulnerability is not exploitable on vz driver, as the guest agent uses vsocks instead of Unix sockets.

Patches Patched in Lima v2.1.3 (8a45892378d22f40505c31a38f786a07701b6d50)

[!NOTE] The default user account in the VM can still run an arbitrary command as the root via the guest agent socket. This is not a vulnerability, as the user can already run an arbitrary command with sudo by design.

Workarounds - On macOS hosts, use vz driver instead of qemu (limactl create --vm-type=vz. Default since v1.0.) - Or, disable the guest agent (limactl create --plain)

An unprivileged user inside a Lima QEMU guest could reach the root-owned guest-agent socket and run commands as root in the VM. Fixed in Lima v2.1.3.

Lima scored it High, CVSS 8.2 with Scope: Changed, reflecting that crossing from an unprivileged account to root within the VM crosses a security boundary that other components rely on.

Full write up is available on the Syntetisk blog.