CVE-2023-32684 – In Lima, a malicious disk image could read a single file on the host filesystem as a qcow2/vmdk backing file

https://notcve.org/view.php?id=CVE-2023-32684

30 May 2023 — Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to version 0.16.0, a virtual machine instance with a malicious disk image could read a single file on the host filesystem, even when no filesystem is mounted from the host. The official templates of Lima and the well-known third party products (Colima, Rancher Desktop, and Finch) are unlikely to be affected by this issue. To exploit this issue, the attacker has to embed the target file path (an absolute or a relative pat... • https://github.com/lima-vm/lima/commit/01dbd4d9cabe692afa4517be3995771f0ebb38a5 • CWE-552: Files or Directories Accessible to External Parties •