Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the host

Impact

restricted.containers.lowlevel=block is the setting that stops a project-scoped user from setting raw.lxc and raw.qemu, the hooks that let an instance config run arbitrary things on the host. Snapshot handling skipped that check, so a user restricted to a project can smuggle a lowlevel hook in through a snapshot and get arbitrary command execution on the Incus server itself. On a host running Incus containers or VMs for several teams, that is the boundary between a delegated project and the machine holding every other instance, including whatever GPU passthrough those instances have. The advisory scores it as a scope change from low privilege to full host compromise.

Who can reach it

An authenticated Incus user with rights over a restricted project - the exact population the restricted.* settings exist to contain. Reachable over the Incus API, no host access needed.

What to do

Upgrade to Incus 7.2.0, which patches the snapshot path, and restart the Incus daemon. Instances keep running across an incus daemon restart, so this is not a drain-and-reboot job. Before upgrading, treat restricted.containers.lowlevel as not enforced: audit existing snapshots for raw.lxc and raw.qemu keys and tighten who may create instances in delegated projects.

References