systemd nspawn Escape-to-Host Vulnerability via Crafted Optional Config File

A vulnerability in systemd nspawn versions 233 through 259 prior to 260 allows for an escape-to-host action through a crafted optional configuration file. This issue arises from two parsing bugs that affect the 'PivotRoot=', 'BindUser=', and 'Ephemeral=' options. When exploited, the container is spawned on the host's root filesystem instead of the container image, with elevated privileges.

Impact

Exploitation of this vulnerability causes containers to be launched on the host's root filesystem with high privileges, rather than within the intended container environment.

Remediation

Users can update to systemd version 260, 259.4, 258.6, or 257.12, all of which include the necessary patches. Alternatively, as a temporary measure, users can sanitize storage directories to prevent the use of '.nspawn' configuration files or ensure that such files do not include the 'PivotRoot=', 'BindUser=', or 'Ephemeral=' options.