description: A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate their privilege to root without requiring a sudo password.
affected:
{
vendor: Canonical
product: Ubuntu Server
platforms: Linux
packageName: Linux
versions:
status: unaffected, version: 0, lessThan: 24.04, versionType: semver
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
baseScore: 5
baseSeverity: MEDIUM
]
workarounds: Remove users from lxd group and configure multi-user LXD mode.
https://discourse.ubuntu.com/t/easy-multi-user-lxd-setup/26215/4