CVE-2018-6556
Fixed in a distro release EPSS <1%
lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). Affected releases are LXC: 2.0 versions above and including 2.0.9; 3.0 versions above and including 3.0.0, prior to 3.0.2.
Products: canonical ubuntu_linux, linuxcontainers lxc, suse caas_platform, suse openstack_cloud, suse_linux_enterprise_server, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | lxc | 2.1.1-r9 |
| Alpine 3.11 | lxc | 2.1.1-r9 |
| Alpine 3.12 | lxc | 2.1.1-r9 |
| Alpine 3.13 | lxc | 2.1.1-r9 |
| Alpine 3.14 | lxc | 2.1.1-r9 |
| Alpine 3.15 | lxc | 2.1.1-r9 |
| Alpine 3.16 | lxc | 2.1.1-r9 |
| Alpine 3.17 | lxc | 2.1.1-r9 |
| Alpine 3.18 | lxc | 2.1.1-r9 |
| Alpine 3.19 | lxc | 2.1.1-r9 |
| Alpine 3.20 | lxc | 2.1.1-r9 |
| Alpine 3.21 | lxc | 2.1.1-r9 |
| Alpine 3.22 | lxc | 2.1.1-r9 |
| Alpine 3.23 | lxc | 2.1.1-r9 |
| Alpine 3.24 | lxc | 2.1.1-r9 |
| Alpine 3.6 | lxc | 2.0.9-r1 |
| Alpine 3.7 | lxc | 2.1.1-r3 |
| Alpine 3.8 | lxc | 2.1.1-r9 |
| Alpine 3.9 | lxc | 2.1.1-r9 |
| Arch Linux | lxc | 1:3.0.2-1 |
| Debian 12 | lxc | 1:2.0.9-6.1 |
| Debian 13 | lxc | 1:2.0.9-6.1 |
| Debian 14 | lxc | 1:2.0.9-6.1 |
| SUSE Package Hub 15 | lxc | 3.1.0-bp150.5.3.1 |
| SUSE Package Hub 15 | lxc | 2.0.9-bp150.5.6.1 |
| SUSE Package Hub 15 | lxcfs | 3.0.3-bp150.3.3.1 |
| Ubuntu 18.04 LTS | lxc | 3.0.1-0ubuntu1~18.04.2 |
| openSUSE Leap 15.0 | lxc | 3.1.0-lp150.2.10.1 |
| openSUSE Leap 15.0 | lxcfs | 3.0.3-lp150.2.3.1 |
| openSUSE Tumbleweed | lxc | 4.0.9-1.1 |