{"schema":"threatline.record/2","record":{"id":"GHSA-4cph-ccqv-hm3c","aliases":["GHSA-4cph-ccqv-hm3c"],"summary":"Project restriction bypass for block.create_options via volume update, copy and move","details":"### Summary\r\n\r\nThe fix for CVE-2026-62867 only rejected `block.create_options` on the direct\r\ncustom volume creation path. The same value could still reach a restricted\r\nproject by setting it on an existing volume, or by copying or moving a volume\r\nwhose config carries it, as those paths inherit the source volume's config\r\nwithout re-checking the target project's restrictions.\r\n\r\n### Impact\r\n\r\nA user confined to a restricted project who can create or edit custom volumes\r\ncan set `block.create_options` on a volume, then trigger a copy or move onto a\r\npool that formats the new volume. The value is appended to the `mkfs` command\r\nline executed as root, giving the same argument injection as the original\r\nissue.\r\n\r\nOnly pools that format on copy, such as non-thin LVM, reach the `mkfs` call.\r\nOn other drivers the forbidden option still lands on the volume.\r\n\r\n### Details\r\n\r\nThe restriction is now enforced on volume update regardless of project limits,\r\nand inside the copy and refresh backends against the effective config after\r\nfalling back to the source volume's config. This covers cross-project copies,\r\ncopies that omit the config field, and moves.\r\n\r\n### Workarounds\r\n\r\nDon't grant custom volume creation to restricted projects on pools that format\r\non copy, or set `volume.block.create_options` on the pool so the pool default\r\napplies.","categories":["Unclassified"],"product":"github.com/lxc/incus/v7/cmd/incusd","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/lxc/incus/security/advisories/GHSA-4cph-ccqv-hm3c","source_modified_at":"2026-09-25T00:53:49Z","fetched_at":"2026-10-24T05:41:33.294140Z","package":{"ecosystem":"go","name":"github.com/lxc/incus/v7/cmd/incusd"},"range":">= v7.3.0, < v7.5.0"}],"fixed_versions":[],"cvss":9.9,"severity":"Critical","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-25T00:53:49Z","modified_at":"2026-09-25T00:53:49Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/lxc/incus/security/advisories/GHSA-4cph-ccqv-hm3c","fetched_at":"2026-10-24T05:41:33.294140Z","source_modified_at":"2026-09-25T00:53:49Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-25T00:53:49Z","content_hash":"69c0f8a2f9d72c12f4fbf85f9111005a6873677ead586af57f8e61e3d2929a55"}}