CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-47952
https://notcve.org/view.php?id=CVE-2022-47952
lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that "we will report back to the user that the open() failed but the user has no way of knowing why it failed"; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist. • https://github.com/MaherAzzouzi/CVE-2022-47952 https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1783591/comments/45 https://github.com/lxc/lxc/blob/0b83d71c2c8f3bac9503f894cd84584f79258bb3/lxc.spec.in#L274 https://github.com/lxc/lxc/blob/0b83d71c2c8f3bac9503f894cd84584f79258bb3/src/lxc/cmd/lxc_user_nic.c#L1085-L1104 https://lists.debian.org/debian-lts-announce/2023/08/msg00025.html • CWE-203: Observable Discrepancy •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-18641
https://notcve.org/view.php?id=CVE-2017-18641
In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers. En LXC versión 2.0, muchos scripts de plantilla descargan código por medio de texto sin cifrar HTTP, y omiten una comprobación de firma digital, antes de ejecutarse en los contenedores de arranque. • https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1661447 • CWE-287: Improper Authentication •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1340 – chmod race in doUidshiftIntoContainer
https://notcve.org/view.php?id=CVE-2015-1340
LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice. LXD anterior a la versión 0,19-0ubuntu5 la función doUidshiftIntoContainer() presenta una llamada no segura chmod() que corre contra la STAT en la función FilePath.Walk(). Un enlace simbólico creado en esa ventana podría hacer que cualquier archivo en el sistema tuviera cualquier modo de elección del atacante. • https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 9.3EPSS: 0%CPEs: 43EXPL: 22CVE-2019-5736 – Docker Container Escape Via runC Overwrite
https://notcve.org/view.php?id=CVE-2019-5736
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe. runc, hasta la versión 1.0-rc6, tal y como se emplea en Docker, en versiones anteriores a la 18.09.2 y otros productos, permite que los atacantes sobrescriban el binario del host runc (y, así, obtengan acceso root al host) aprovechando la capacidad para ejecutar un comando como root con uno de estos tipos de contenedores: (1) un nuevo contenedor con una imagen controlada por el atacante o (2) un contenedor existente, para el cual el atacante contaba previamente con acceso de escritura, que puede adjuntarse con docker exec. Esto ocurre debido a la gestión incorrecta del descriptor de archivos; esto está relacionado con /proc/self/exe. A flaw was found in the way runc handled system file descriptors when running containers. A malicious container could use this flaw to overwrite contents of the runc binary and consequently run arbitrary commands on the container host system. • https://github.com/Frichetten/CVE-2019-5736-PoC https://www.exploit-db.com/exploits/46369 https://www.exploit-db.com/exploits/46359 https://github.com/twistlock/RunC-CVE-2019-5736 https://github.com/jas502n/CVE-2019-5736 https://github.com/RyanNgWH/CVE-2019-5736-POC https://github.com/zyriuse75/CVE-2019-5736-PoC https://github.com/likescam/CVE-2019-5736 https://github.com/geropl/CVE-2019-5736 https://github.com/si1ent-le/CVE-2019-5736 https://github.com/ • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 3.3EPSS: 0%CPEs: 9EXPL: 0CVE-2018-6556 – The lxc-user-nic component of LXC allows unprivileged users to open arbitrary files
https://notcve.org/view.php?id=CVE-2018-6556
lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). Affected releases are LXC: 2.0 versions above and including 2.0.9; 3.0 versions above and including 3.0.0, prior to 3.0.2. Cuando se solicita a lxc-user-nic que elimine una interfaz de red, abrirá de forma incondicional una ruta proporcionada por el usuario. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00076.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1783591 https://bugzilla.suse.com/show_bug.cgi?id=988348 https://security.gentoo.org/glsa/201808-02 https://usn.ubuntu.com/usn/usn-3730- • CWE-417: Communication Channel Errors •