The Incus server improperly enforces the restricted.containers.lowlevel=block setting when handling instance snapshots. Snapshots ignore this restriction, allowing an attacker to embed lowlevel hooks (e.g., raw.lxc) that execute arbitrary commands with root privileges on the host. The attack involves creating a malicious instance and snapshot in an unrestricted environment, transferring it to a restricted project, and restoring the snapshot to trigger command execution. This results in a bypass of project restrictions and full arbitrary command execution on the Incus server.

This vulnerability allows an attacker with the ability to transfer instances and snapshots to a restricted project to bypass container low-level restrictions and execute arbitrary commands on the Incus server with root privileges. This leads to full compromise of the host system, including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid transferring and restoring snapshots between unrestricted and restricted projects, especially if lowlevel hooks might be present. Monitor vendor communications for patches or official mitigations.