CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-47952
https://notcve.org/view.php?id=CVE-2022-47952
lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that "we will report back to the user that the open() failed but the user has no way of knowing why it failed"; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist. • https://github.com/MaherAzzouzi/CVE-2022-47952 https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1783591/comments/45 https://github.com/lxc/lxc/blob/0b83d71c2c8f3bac9503f894cd84584f79258bb3/lxc.spec.in#L274 https://github.com/lxc/lxc/blob/0b83d71c2c8f3bac9503f894cd84584f79258bb3/src/lxc/cmd/lxc_user_nic.c#L1085-L1104 https://lists.debian.org/debian-lts-announce/2023/08/msg00025.html • CWE-203: Observable Discrepancy •
CVSS: 9.3EPSS: 0%CPEs: 43EXPL: 22CVE-2019-5736 – Docker Container Escape Via runC Overwrite
https://notcve.org/view.php?id=CVE-2019-5736
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe. runc, hasta la versión 1.0-rc6, tal y como se emplea en Docker, en versiones anteriores a la 18.09.2 y otros productos, permite que los atacantes sobrescriban el binario del host runc (y, así, obtengan acceso root al host) aprovechando la capacidad para ejecutar un comando como root con uno de estos tipos de contenedores: (1) un nuevo contenedor con una imagen controlada por el atacante o (2) un contenedor existente, para el cual el atacante contaba previamente con acceso de escritura, que puede adjuntarse con docker exec. Esto ocurre debido a la gestión incorrecta del descriptor de archivos; esto está relacionado con /proc/self/exe. A flaw was found in the way runc handled system file descriptors when running containers. A malicious container could use this flaw to overwrite contents of the runc binary and consequently run arbitrary commands on the container host system. • https://github.com/Frichetten/CVE-2019-5736-PoC https://www.exploit-db.com/exploits/46369 https://www.exploit-db.com/exploits/46359 https://github.com/twistlock/RunC-CVE-2019-5736 https://github.com/jas502n/CVE-2019-5736 https://github.com/RyanNgWH/CVE-2019-5736-POC https://github.com/zyriuse75/CVE-2019-5736-PoC https://github.com/likescam/CVE-2019-5736 https://github.com/geropl/CVE-2019-5736 https://github.com/si1ent-le/CVE-2019-5736 https://github.com/ • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-5985
https://notcve.org/view.php?id=CVE-2017-5985
lxc-user-nic in Linux Containers (LXC) allows local users with a lxc-usernet allocation to create network interfaces on the host and choose the name of those interfaces by leveraging lack of netns ownership check. lxc-user-nic en Linux Containers (LXC) permite a usuarios locales con una asignación lxc-usernet crear interfaces de red en el host y elegir el nombre de esas interfaces aprovechando la falta de verificación de propiedad de netns. • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html http://www.openwall.com/lists/oss-security/2017/03/09/4 http://www.securityfocus.com/bid/96777 http://www.ubuntu.com/usn/USN-3224-1 https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1654676 https://github.com/lxc/lxc/commit/16af238036a5464ae8f2420ed3af214f0de875f9 https://lists.linuxcontainers.org/pipermail/lxc-devel/2017-March/015535.html • CWE-862: Missing Authorization •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10124
https://notcve.org/view.php?id=CVE-2016-10124
An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container. Se ha descubierto un problema en Linux Containers (LXC) en versiones anteriores a 22-02-2016. Cuando se ejecuta un programa a través de lxc-attach, la sesión no privada puede escapar a la sesión parental utilizando el ioctl TIOCSTI para presionar caracteres en el búfer de entrada del terminal, permitiendo a un atacante escapar del contenedor. • http://www.openwall.com/lists/oss-security/2014/12/15/5 http://www.openwall.com/lists/oss-security/2015/09/03/5 http://www.securityfocus.com/bid/95404 https://github.com/lxc/lxc/commit/e986ea3dfa4a2957f71ae9bfaed406dd6e1ffff6 https://security.gentoo.org/glsa/201711-09 • CWE-284: Improper Access Control •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2016-8649
https://notcve.org/view.php?id=CVE-2016-8649
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls. lxc-attach en LXC entre las versiones 1.0.9 y 2.x hasta la versión 2.0.6 permite que un atacante dentro de un contenedor sin privilegios, utilice un descriptor de archivo heredado de la carpeta /proc del host para acceder al resto del sistema de archivos del host a través de llamadas al sistema openat(). • http://www.securityfocus.com/bid/94498 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845465 https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1639345 https://bugzilla.redhat.com/show_bug.cgi?id=1398242 https://github.com/lxc/lxc/commit/81f466d05f2a89cb4f122ef7f593ff3f279b165c https://security-tracker.debian.org/tracker/CVE-2016-8649 • CWE-264: Permissions, Privileges, and Access Controls •