CVE-2018-6556 The lxc-user-nic component of LXC allows unprivileged users to open arbitrary files
LowCVSS 3.3
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). Affected releases are LXC: 2.0 versions above and including 2.0.9; 3.0 versions above and including 3.0.0, prior to 3.0.2.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/lxc(Debian:12) | < 1:2.0.9-6.1 | 1:2.0.9-6.1 |
| debian/lxc(Debian:13) | < 1:2.0.9-6.1 | 1:2.0.9-6.1 |
| debian/lxc(Debian:14) | < 1:2.0.9-6.1 | 1:2.0.9-6.1 |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| linuxcontainers lxc | >= 2.0.0, <= 2.0.9 | No fix listed |
| linuxcontainers lxc | >= 3.0.0, < 3.0.2 | 3.0.2 |
| SUSE caas platform | = 1.0 | No fix listed |
| SUSE caas platform | = 2.0 | No fix listed |
| SUSE openstack cloud | = 6 | No fix listed |
| suse linux enterprise server | = 11-sp3 | No fix listed |
| suse linux enterprise server | = 11-sp4 | No fix listed |
| openSUSE leap | = 15.0 | No fix listed |
| alpine/lxc(Alpine:v3.10) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
| alpine/lxc(Alpine:v3.11) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
| alpine/lxc(Alpine:v3.12) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
| alpine/lxc(Alpine:v3.13) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
| alpine/lxc(Alpine:v3.14) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
| alpine/lxc(Alpine:v3.15) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
| alpine/lxc(Alpine:v3.16) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
| alpine/lxc(Alpine:v3.17) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
| alpine/lxc(Alpine:v3.18) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
| alpine/lxc(Alpine:v3.19) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
| alpine/lxc(Alpine:v3.20) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
| alpine/lxc(Alpine:v3.21) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
| alpine/lxc(Alpine:v3.22) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/lxc(Alpine:v3.23) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
| alpine/lxc(Alpine:v3.24) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
| alpine/lxc(Alpine:v3.6) | >= 2.0.0, < 2.0.9-r1 | 2.0.9-r1 |
| alpine/lxc(Alpine:v3.7) | >= 2.0.0, < 2.1.1-r3 | 2.1.1-r3 |
| alpine/lxc(Alpine:v3.8) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
| alpine/lxc(Alpine:v3.9) | >= 2.0.0, < 2.1.1-r9 | 2.1.1-r9 |
References
- Debian Security Tracker CVE-2018-6556 vendor-advisory
- openSUSE-SU-2019:1227 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2019:1230 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2019:1275 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2019:1481 vendor-advisory
- bugs.launchpad.net issue-tracking third-party-advisory
- bugzilla.suse.com issue-tracking patch
- GLSA-201808-02 third-party-advisory vendor-advisory
- USN-3730-1 third-party-advisory vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking