Upstream information

CVE-2025-52890 at MITRE

Description

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v3 Scores
  CNA (GitHub)
Base Score 8.1
Vector CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
Attack Vector Adjacent Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Changed
Confidentiality Impact High
Integrity Impact None
Availability Impact High
CVSSv3 Version 3.1
SUSE Bugzilla entry: 1245367 [RESOLVED / FIXED]

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
openSUSE Tumbleweed
  • govulncheck-vulndb >= 0.0.20250730T213748-1.1
  • incus >= 6.14-1.1
  • incus-bash-completion >= 6.14-1.1
  • incus-fish-completion >= 6.14-1.1
  • incus-tools >= 6.14-1.1
  • incus-zsh-completion >= 6.14-1.1
 Patchnames:
openSUSE-Tumbleweed-2025-15317
openSUSE-Tumbleweed-2025-15405

SUSE Timeline for this CVE

CVE page created: Wed Jun 25 20:44:51 2025
CVE page last modified: Thu Aug 7 12:38:02 2025