## Summary
LXD contains an authorization bypass that allows an authenticated user to exceed project-level disk and volume limits by abusing two volume-related code paths. This can enable cross-tenant resource exhaustion (DoS) by allocating storage beyond administrative quotas.
## Technical Details
- Path 1: Volume move bypass
- In lxd/storage_volumes.go, storagePoolVolumeTypePostMove (around line 1968) creates the target volume via newPool.CreateCustomVolumeFromCopy(...) (around line 1992) without calling limits.AllowVolumeCreation.
- The advisory notes this differs from storagePoolVolumesTypePost (around line 1081), which *does* call limits.AllowVolumeCreation before creation.
- Path 2: Snapshot restore bypass
- In lxd/storage_volumes.go (around lines 2239-2249), the AllowVolumeUpdate limit check is gated by a condition that effectively skips the check when req.Config == nil.
- Specifically, the advisory describes: when doing a “pure snapshot restore” (Config == nil, Restore set), AllowVolumeUpdate is not invoked.
## Affected
- LXD (authorization bypass in volume operations affecting project disk/volume limits)
## Impact
- Attackers can:
- Move large volumes into quota-limited projects, exceeding limits.disk / volume limits.
- Restore snapshots that recreate volumes larger than the project’s current limits.
- In multi-tenant clusters, this can lead to resource exhaustion affecting other tenants.
## Mitigation
1. Apply the vendor fix from the referenced Canonical LXD security advisory (GHSA-5h78-p252-989h).
2. As a compensating control, restrict authenticated users’ ability to perform lxc storage volume move and lxc storage volume restore operations across projects.
3. Monitor for abnormal quota behavior in project-scoped storage operations (e.g., volumes appearing in a limited project that exceed configured limits.disk).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-770