Lima - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/lima/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 14 Aug 2026 20:06:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLocal Privilege Escalation in Lima via Guest Agent Sockethttps://feed.craftedsignal.io/briefs/2026-08-lima-guest-agent-privesc/Fri, 14 Aug 2026 20:06:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-lima-guest-agent-privesc/An arbitrary user within a QEMU-based Lima VM can exploit improper access controls on the guest agent Unix socket (/run/lima-guestagent.sock) to execute arbitrary commands with root privileges within the guest VM.Lima, a project providing Linux virtual machines on macOS, contains a vulnerability (CVE-2026-53657) affecting instances using the QEMU driver. An arbitrary user within the guest VM can access the guest agent Unix socket located at /run/lima-guestagent.sock. Because this socket provides tunneling services for arbitrary addresses, including those used by privileged system daemons like D-Bus, an unprivileged user can craft requests to execute arbitrary commands with root privileges within the guest instance. This issue is specific to the QEMU driver; the 'vz' driver is unaffected as it utilizes vsocks. The vulnerability is patched in Lima version 2.1.3.

Impact

The vulnerability allows for local privilege escalation (LPE) within the context of a Lima virtual machine. Successful exploitation grants an unprivileged guest user root-level command execution. The scope is limited to the VM instance itself and does not directly result in root access on the macOS host.

Recommendation

  • Upgrade the Lima installation to version 2.1.3 or higher to address CVE-2026-53657.
  • If upgrading is not immediately feasible, switch to the 'vz' driver for VM instances using 'limactl create --vm-type=vz' or disable the guest agent using the '--plain' flag during VM creation.
  • Audit existing VM configurations to identify instances currently using the QEMU driver.
]]>highadvisoryprivilege-escalationvirtualizationcve-2026-53657