Larrasket

**Name of the Vulnerable Software and Affected Versions** Canonical LXD (affected versions not specified) **Description** Broken Access Control in the `devLXDInstancePatchHandler` component allows an untrusted guest to mount, read, and overwrite the custom storage volume of another guest. This is achieved by sending a crafted device PATCH request over the `/dev/lxd` endpoint when the `security.devlxd.management.volumes` setting is enabled. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Disable the `security.devlxd.management.volumes` setting to prevent the exploitation of this issue.