CVE-2025-52890

Executive Summary

CVE-2025-52890 is a high-severity vulnerability (CVSS 8.1) affecting Incus versions 6.12 and 6.13, a system container and virtual machine manager. The flaw resides in the generation of nftables rules when an Access Control List (ACL) is applied to a device connected to a bridge. This misconfiguration partially bypasses the security options security.mac_filtering, security.ipv4_filtering, and security.ipv6_filtering, enabling an attacker to perform ARP spoofing on the bridge and fully spoof another VM or container on the same bridge. The vulnerability has a low EPSS score (0.0%) and no public proof-of-concept (POC) or exploit code is available. A patch is available via commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a core Incus product issue.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.1 (High)
• Attack Vector (AV): Adjacent Network (AV:A) – The attacker must be on the same bridge network.
• Attack Complexity (AC): Low (AC:L) – No special conditions required.
• Privileges Required (PR): Low (PR:L) – Attacker needs a low-privileged container/VM on the bridge.
• User Interaction (UI): None (UI:N) – No user action needed.
• Scope (S): Unchanged (S:U) – The vulnerable component and the attacker are in the same security authority.
• Confidentiality (C): High (C:H) – Full data exposure possible.
• Integrity (I): High (I:H) – Full data manipulation possible.
• Availability (A): High (A:H) – Potential denial of service via spoofing.

Threat Level: High. The vulnerability allows a low-privileged attacker on the same bridge to fully compromise the confidentiality, integrity, and availability of other VMs/containers.

Deep Dive & Mechanics

The vulnerability arises from how Incus generates nftables rules when an ACL is applied to a bridge-connected device. The security options security.mac_filtering, security.ipv4_filtering, and security.ipv6_filtering are designed to restrict traffic based on MAC and IP addresses. However, when an ACL is present, the generated nftables rules are incomplete, allowing certain packets to bypass these filters.

Specifically, the ACL rules are inserted before the filtering rules, causing the filtering rules to be evaluated only after the ACL rules have already accepted or dropped packets. This ordering issue means that packets matching ACL rules can bypass the MAC/IP filtering checks, enabling an attacker to spoof the MAC or IP address of another container/VM on the same bridge.

The attack vector is ARP spoofing: an attacker can send crafted ARP packets to associate their MAC address with the IP address of a victim container/VM. Since the MAC/IP filtering is bypassed, the bridge forwards these packets, allowing the attacker to intercept traffic intended for the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Incus 6.12/6.13): The nftables rule generation logic places ACL rules before filtering rules. For example, the generated ruleset might look like:

table inet incus {
    chain acl {
        # ACL rules (e.g., allow specific traffic)
        ...
    }
    chain filter {
        # MAC/IP filtering rules
        ...
    }
}

The acl chain is evaluated first, and if a packet matches an ACL rule, it is accepted without reaching the filter chain.

Patched Code (Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8): The patch reorders the rule generation so that filtering rules are evaluated before ACL rules. The patched ruleset might look like:

table inet incus {
    chain filter {
        # MAC/IP filtering rules (evaluated first)
        ...
    }
    chain acl {
        # ACL rules (evaluated after filtering)
        ...
    }
}

This ensures that MAC/IP filtering is applied to all packets before ACL rules are considered.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Two containers/VMs on the same Incus bridge (e.g., incusbr0).
• Attacker container has low privileges.
• ACL is applied to the bridge device.

Exploitation Steps:

1. Identify Victim: Determine the IP address of the target container/VM (e.g., 10.0.0.2).
2. Craft ARP Spoofing Packet: Use a tool like arpspoof or scapy to send a forged ARP reply.

   # Using arpspoof (from dsniff package)
   arpspoof -i eth0 -t 10.0.0.1 10.0.0.2
   

   This tells the gateway (10.0.0.1) that the attacker's MAC is associated with 10.0.0.2.
3. Intercept Traffic: After successful spoofing, the attacker can intercept traffic intended for the victim.
4. Maintain Spoofing: Continuously send ARP replies to keep the spoofed entry in the gateway's ARP cache.

Expected Outcome: The attacker can perform man-in-the-middle (MITM) attacks, intercepting and modifying traffic between the victim and the network.

Blue Team (Detection & Mitigation)

Detection:

• Monitor ARP tables for inconsistencies (e.g., multiple IPs with the same MAC).
• Use network monitoring tools like arpwatch or wireshark to detect unusual ARP traffic.
• Check nftables rules for incorrect ordering.

Mitigation:

• Apply the patch immediately (commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8).
• As a temporary workaround, avoid using ACLs on bridge devices until patched.
• Implement static ARP entries for critical hosts.
• Use network segmentation to limit the blast radius.

Indicators of Compromise (IOCs)

• Network Traffic: Unusual ARP replies with inconsistent MAC-IP mappings.
• System Logs: Entries in /var/log/syslog or dmesg indicating ARP spoofing attempts.
• nftables Rules: Presence of rules where ACL chains are evaluated before filter chains.
• ARP Cache: Multiple IP addresses mapping to the same MAC address on the gateway.

Detection Engineering

YARA Rule

rule CVE_2025_52890_Incus_ACL_Bypass {
    meta:
        description = "Detects Incus nftables rules with ACL before filter chains"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52890"
    strings:
        $acl_chain = "chain acl" nocase
        $filter_chain = "chain filter" nocase
        $incus_table = "table inet incus" nocase
    condition:
        $incus_table and $acl_chain and $filter_chain and @acl_chain < @filter_chain
}

Sigma Rule

title: Incus ACL Bypass via nftables Rule Ordering
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects misconfigured nftables rules where ACL chains are evaluated before filter chains in Incus.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-52890
logsource:
    product: linux
    service: nftables
detection:
    selection:
        - "chain acl"
        - "chain filter"
    condition: selection and position(chain acl) < position(chain filter)
falsepositives:
    - Intentional custom configurations
level: high

Suricata Rule

alert arp any any -> any any (msg:"CVE-2025-52890 Incus ACL Bypass - ARP Spoofing Attempt"; content:"|00 01 08 00 06 04 00 01|"; offset:0; depth:8; classtype:attempted-recon; sid:1000001; rev:1;)

Note: This rule detects common ARP request/reply patterns. Adjust content based on specific ARP packet structure.

Remediation & Mitigation

Immediate Actions:

1. Apply Patch: Upgrade Incus to a version containing commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 or later.
2. Workaround: Remove ACLs from bridge devices until patched.
3. Network Segmentation: Isolate critical VMs/containers on separate bridges.

Long-Term Measures:

• Implement network monitoring for ARP spoofing (e.g., arpwatch, snort).
• Use static ARP entries for critical infrastructure.
• Regularly audit nftables rules for correct ordering.
• Subscribe to Incus security advisories for timely updates.

Valters IT