DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-53657: CVE-2026-53657: Privilege Escalation via Overly Permissive Unix Domain Socket in Lima Guest Agent

#security #cve #cybersecurity

CVE-2026-53657: Privilege Escalation via Overly Permissive Unix Domain Socket in Lima Guest Agent

Vulnerability ID: CVE-2026-53657
CVSS Score: 8.2
Published: 2026-08-14

CVE-2026-53657 is a local privilege escalation vulnerability in Lima (lima-vm/lima) affecting versions prior to 2.1.3 when configured with the QEMU driver. The guest agent daemon, running as root, creates its communication socket /run/lima-guestagent.sock with world-writable permissions (0777). This allows unprivileged local users to command the agent to establish arbitrary tunnels, including to privileged local UNIX sockets (like D-Bus). Because the target daemon authenticates the incoming connection using the credentials of the root-owned guest agent (via SO_PEERCRED), unprivileged users can perform root operations, resulting in complete guest VM compromise.

TL;DR

Lima guest agent socket /run/lima-guestagent.sock is created with 0777 permissions under QEMU, enabling unprivileged local users to execute arbitrary commands as root via a Confused Deputy tunnel to privileged sockets like D-Bus.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-276, CWE-668
  • Attack Vector: Local (AV:L)
  • CVSS v3.1: 8.2 (High)
  • EPSS Score: 0.00129
  • Impact: Privilege Escalation to root inside the Guest VM
  • Exploit Status: poc/conceptual (none weaponized)
  • KEV Status: Not Listed

Affected Systems

  • Lima (lima-vm/lima) under QEMU driver
  • Lima: < 2.1.3 (Fixed in: 2.1.3)

Code Analysis

Commit: b08cae8

Fix guestagent UNIX socket permissions (main branch)

Commit: 8a45892

Fix guestagent UNIX socket permissions (release/2.1 branch)

Commit: 1285a6d

Consolidated merge commit addressing insecure socket permissions

Mitigation Strategies

  • Upgrade Lima to version 2.1.3 or later
  • Manually restrict socket file permissions within the VM using chmod and chown
  • Configure the VM to use vsock-based communication instead of filesystem UNIX sockets

Remediation Steps:

  1. Identify running instances of Lima virtual machines using older versions.
  2. Upgrade the host installation of Lima to version 2.1.3 or later using package managers or binary releases.
  3. Restart running guest VMs to apply updated cloud-init configurations and provision the patched guest agent.
  4. For systems where immediate upgrades are not possible, execute a script or cron job inside the guest VM as root to change ownership of '/run/lima-guestagent.sock' to the primary user and set permissions to 0600.

References

Read the full report for CVE-2026-53657 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)