CVE-2024-3250: 
NixOS vulnerability analysis and mitigation

Canonical's Pebble service manager read-file API and the associated pebble pull command, before version 1.10.2, contained a vulnerability that allowed unprivileged local users to read files with root-equivalent permissions when Pebble was running as root. The vulnerability was discovered and reported in April 2024, affecting multiple versions of the software (GHSA Advisory, NVD).

The vulnerability is classified as an incorrect permission assignment for critical resource (CWE-732). It has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. The issue specifically affects the API behind the pebble pull command, which is used to read files from the workload container by Juju charms. The vulnerability allows access from any user instead of restricting it to admin users only (GHSA Advisory).

In environments where Pebble runs as root, particularly in Juju Kubernetes sidecar charms, if a restricted unix user gains local access to the container host, they could exploit the GET /v1/files?action=read API to read any file in the workload container. This could lead to exposure of sensitive information such as SSH keys, database passwords, or other confidential data (GHSA Advisory).

The vulnerability requires local user access to the host machine. While exploitation in a Juju Kubernetes context is considered unlikely, if an attacker gains local access and sensitive information is present in files accessible to Pebble, the consequences could be severe (GHSA Advisory).

The vulnerability has been fixed in multiple versions: Pebble v1.1.1, v1.4.2, v1.7.4, and v1.10.2. Juju has also released patch versions with the fix: Juju 2.9.49 (Pebble v1.1.1), Juju 3.1.8 (Pebble v1.4.2), Juju 3.3.4 (Pebble v1.4.2), Juju 3.4.2 (Pebble v1.7.4), and Juju 3.5.0 (Pebble v1.10.2) (GHSA Advisory).