Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket

Impact

On an instance of Lima running with qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled.

This could result in running an arbitrary command with the root privileges in the VM (not on the host), as lima-guestagent.sock provides the tunneling service for an arbitrary address, including a Unix socket address for privileged daemons like D-Bus.

This vulnerability is not exploitable on vz driver, as the guest agent uses vsocks instead of Unix sockets.

Patches

Patched in Lima v2.1.3 (8a45892378d22f40505c31a38f786a07701b6d50)

[!NOTE] The default user account in the VM can still run an arbitrary command as the root via the guest agent socket. This is not a vulnerability, as the user can already run an arbitrary command with sudo by design.

Workarounds

• On macOS hosts, use vz driver instead of qemu (limactl create --vm-type=vz. Default since v1.0.)
• Or, disable the guest agent (limactl create --plain)