CVE-2026-33743: 
NixOS vulnerability analysis and mitigation

CVE-2026-33743 is a denial-of-service vulnerability in Incus, a system container and virtual machine manager developed by Linux Containers (lxc). Prior to version 6.23.0, an authenticated user with access to the storage bucket feature can supply a specially crafted backup archive to crash the Incus daemon (incusd), making the control plane API unavailable. The vulnerability was discovered by the team at 7asecurity, disclosed on March 26, 2026, and fixed in version 6.23.0 released the same day. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is an unchecked string slicing operation in the S3 transfer manager (internal/server/storage/s3/transfer_manager.go), classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-1286 (Improper Validation of Syntactic Correctness of Input). In the UploadAllFiles function, tar archive entries are processed and the backup/bucket/ prefix (14 characters) is stripped from each non-index header name via hdr.Name[len("backup/bucket/"):] without first verifying that the header name is at least that length. In Go, slicing a string with a starting index beyond its length triggers a runtime panic, immediately terminating the daemon. An attacker only needs low-privilege authenticated access to the storage bucket import feature to trigger this condition (Github Advisory).

Successful exploitation causes an immediate crash of the incusd daemon, rendering the Incus control plane API unavailable. Repeated submission of the malicious archive can keep the server offline indefinitely, preventing administrators from managing containers and virtual machines. Critically, running workloads — existing containers and VMs — are not affected and continue to operate normally during the attack; the impact is limited to availability of the management plane with no confidentiality or integrity consequences (Github Advisory, Red Hat Bugzilla).

A public proof-of-concept (PoC) Python script is available within the official security advisory, demonstrating creation of a malicious s3_panic.tar.gz archive that triggers the slice-bounds panic in the S3 restore path. The exploit requires only low-privilege authenticated access and no user interaction, making it straightforward to weaponize. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.039% (0.022% per GitHub Advisory), placing it in a low exploitation-probability tier (Github Advisory, Feedly).

1. Prerequisite: Obtain authenticated access to an Incus instance with the storage bucket feature enabled (low-privilege user with bucket import permissions is sufficient).
2. Enable storage buckets listener (if not already active): On the Incus host, run incus config set core.storage_buckets_address :4443 to ensure the S3 transfer path is initialized.
3. Craft the malicious archive: Using the public PoC Python script, generate a tar.gz archive (s3_panic.tar.gz) containing a valid backup/index.yaml entry and a second entry with a header name shorter than the 14-character backup/bucket/ prefix (e.g., backup/x). Run: python3 poc_s3_slicing.py.
4. Trigger the vulnerable import: From an Incus client with storage bucket import permissions, execute: incus storage bucket import <pool-name> s3_panic.tar.gz <bucket-name>. The client will receive an Error: Operation not found response.
5. Daemon crash confirmed: On the Incus host, the daemon terminates with panic: runtime error: slice bounds out of range [14:8] in TransferManager.UploadAllFiles at transfer_manager.go:139. Verify with: journalctl -u incus -n 50 | grep -A 15 "panic".
6. Sustain DoS: Repeat the import command to prevent the daemon from recovering, keeping the control plane API offline (Github Advisory).

• Logs: journalctl -u incus entries containing panic: runtime error: slice bounds out of range [14:8] with a goroutine stack trace pointing to github.com/lxc/incus/v6/internal/server/storage/s3.TransferManager.UploadAllFiles at transfer_manager.go:139.
• Logs: Repeated Incus daemon crash/restart events in system logs (systemd reporting incusd service failures or restarts in quick succession).
• Logs: Incus API audit logs showing repeated storage bucket import operations from the same user or source IP, particularly targeting different pool or bucket names.
• File System: Presence of files named s3_panic.tar.gz or similarly named crafted archives on client systems or in temporary upload directories.
• Network: Repeated authenticated API calls to the Incus storage bucket import endpoint from a single source IP, especially if followed by daemon unavailability (Github Advisory).

Upgrade Incus to version 6.23.0 or later, which validates that tar header names begin with the expected backup/bucket/ prefix and are of sufficient length before performing the string slice operation. As a workaround prior to patching, restrict access to the storage bucket import feature to trusted administrators only, and implement network-level access controls to limit who can authenticate to Incus systems. Monitoring Incus daemon logs for unexpected crashes can help detect exploitation attempts in the interim (Github Advisory, Red Hat Bugzilla).

The vulnerability was discovered and reported by the team at 7asecurity and remediated by Incus maintainer stgraber (Stéphane Graber), who published the advisory and patch on the same day (March 26, 2026). Downstream Linux distributions including Debian and openSUSE issued security advisories and package updates shortly after disclosure. No significant broader media coverage or notable social media controversy has been observed, consistent with the moderate severity and limited exploitation scope of the vulnerability (Github Advisory).