CVE-2025-52889

Executive Summary

CVE-2025-52889 is a medium-severity vulnerability affecting Incus versions 6.12 and 6.13. The flaw resides in the bridge ACL (Access Control List) implementation, where nftables rules for local services (DHCP, DNS) are generated in a way that partially bypasses the security options security.mac_filtering, security.ipv4_filtering, and security.ipv6_filtering. This bypass allows an attacker with local access to a container or VM to perform DHCP pool exhaustion attacks and potentially other network-based attacks. The vulnerability has a CVSS score of 3.4, indicating low severity, but it can be exploited in multi-tenant environments to degrade network services.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the Incus system container and virtual machine manager, which is typically distributed as a system package (e.g., via APT or YUM). Users should verify their Incus version and apply the patch from the official repository.

CVSS Breakdown & Threat Level

• CVSS Score: 3.4 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Local (AV:L) – requires local access to a container or VM.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker needs a user account inside the container/VM.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not cross security boundaries.
• Confidentiality Impact: None (C:N) – no data exposure.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: Low (A:L) – DHCP exhaustion can degrade network availability.

Threat Level: Low. Exploitation requires local access and primarily affects availability. However, in shared hosting or multi-tenant environments, it could be used to disrupt network services for other tenants.

Deep Dive & Mechanics

Incus uses nftables to enforce network security policies for containers and VMs. When an ACL is applied to a device connected to a bridge, Incus generates rules for local services (DHCP, DNS) to allow necessary traffic. The vulnerability occurs because these generated rules are not properly filtered by the security.mac_filtering, security.ipv4_filtering, and security.ipv6_filtering options.

Specifically, the nftables rules for DHCP and DNS are placed in a chain that is evaluated before the filtering rules. This means that even if MAC or IP filtering is enabled, a container can still send DHCP requests with arbitrary MAC addresses or IP addresses, bypassing the intended restrictions. This allows an attacker to:

• Exhaust the DHCP pool by sending many requests with different MAC addresses.
• Potentially perform ARP spoofing or other network attacks by using unauthorized IP addresses.

The root cause is a logic error in the rule generation code, where the ACL rules for local services are not subject to the same filtering checks as other traffic.

Vulnerable vs. Patched Code

Vulnerable Code (Incus 6.12/6.13): In the bridge ACL setup, the nftables rules for DHCP and DNS are added to a chain that is evaluated before the filtering chain. For example:

# Vulnerable: DHCP rules bypass MAC filtering
nft add rule inet incus bridge_acl_<bridge> udp dport 67 accept
nft add rule inet incus bridge_acl_<bridge> udp dport 68 accept

Patched Code (Commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214): The patch moves the DHCP and DNS rules to a chain that is evaluated after the filtering rules, or adds explicit checks to ensure that the source MAC/IP matches the allowed values. For example:

# Patched: DHCP rules are filtered by MAC
nft add rule inet incus bridge_acl_<bridge> ether saddr <allowed_mac> udp dport 67 accept
nft add rule inet incus bridge_acl_<bridge> ether saddr <allowed_mac> udp dport 68 accept

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites: Local access to a container or VM running on Incus 6.12 or 6.13 with an ACL applied to a bridge device.

Exploitation Steps:

1. Identify the bridge network and ACL configuration.
2. Use a tool like dhcpig or a custom script to send DHCP requests with random MAC addresses.
3. Observe DHCP pool exhaustion as the server assigns IPs to fake requests.
4. Optionally, send packets with unauthorized IP addresses to test IP filtering bypass.

Example Command:

# Send DHCP requests with random MACs
sudo dhcpig -i eth0 -m random -c 1000

Blue Team (Defender)

Detection:

• Monitor DHCP server logs for excessive requests from the same container/VM.
• Use network monitoring tools to detect unusual DHCP traffic patterns.
• Check nftables rules for missing MAC/IP filtering on DHCP/DNS ports.

Mitigation:

• Apply the patch from commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214.
• As a workaround, manually add nftables rules to filter DHCP/DNS traffic by allowed MAC/IP addresses.
• Restrict container/VM network access using additional firewall rules.

Indicators of Compromise (IOCs)

• Network: High volume of DHCP DISCOVER/REQUEST packets from a single container/VM.
• Logs: DHCP server logs showing rapid IP address assignments to different MAC addresses.
• System: Unusual nftables rules that allow DHCP/DNS traffic without MAC/IP filtering.

Detection Engineering

YARA Rule

rule CVE_2025_52889_Incus_ACL_Bypass {
    meta:
        description = "Detects Incus nftables rules that bypass MAC/IP filtering for DHCP/DNS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52889"
    strings:
        $rule1 = "udp dport 67 accept" ascii wide
        $rule2 = "udp dport 68 accept" ascii wide
        $rule3 = "udp dport 53 accept" ascii wide
    condition:
        any of ($rule*) and not ($rule* contains "ether saddr" or $rule* contains "ip saddr")
}

Sigma Rule

title: Incus ACL Bypass for DHCP/DNS Traffic
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects nftables rules that allow DHCP/DNS traffic without MAC/IP filtering, indicating CVE-2025-52889 exploitation.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-52889
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'nftables'
        rule: 'udp dport 67 accept' or 'udp dport 68 accept' or 'udp dport 53 accept'
    filter:
        rule: 'ether saddr' or 'ip saddr'
    condition: selection and not filter
falsepositives:
    - Legitimate rules that allow DHCP/DNS without filtering (unlikely in secure environments)
level: medium
tags:
    - attack.t1190
    - cve.2025.52889

Suricata Rule

alert udp any any -> any 67 (msg:"CVE-2025-52889 Incus ACL Bypass - DHCP Request from Unfiltered MAC"; content:"|01 01 06 00|"; depth:4; offset:0; classtype:attempted-dos; sid:1000001; rev:1;)
alert udp any any -> any 68 (msg:"CVE-2025-52889 Incus ACL Bypass - DHCP Response to Unfiltered MAC"; classtype:attempted-dos; sid:1000002; rev:1;)

Remediation & Mitigation

1. Apply Patch: Update Incus to a version that includes commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214.
2. Workaround: Manually add nftables rules to restrict DHCP/DNS traffic to allowed MAC/IP addresses.
3. Monitor: Enable logging for DHCP and DNS traffic to detect anomalies.
4. Restrict Access: Use network segmentation to limit the impact of compromised containers/VMs.

Valters IT
Securing Digital Frontiers