CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-47952
https://notcve.org/view.php?id=CVE-2022-47952
01 Jan 2023 — lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that "we will report back to the user that the open() failed but the user has no way of k... • https://github.com/MaherAzzouzi/CVE-2022-47952 • CWE-203: Observable Discrepancy •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-18641
https://notcve.org/view.php?id=CVE-2017-18641
10 Feb 2020 — In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers. En LXC versión 2.0, muchos scripts de plantilla descargan código por medio de texto sin cifrar HTTP, y omiten una comprobación de firma digital, antes de ejecutarse en los contenedores de arranque. • https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1661447 • CWE-287: Improper Authentication •
CVSS: 9.3EPSS: 0%CPEs: 43EXPL: 39CVE-2019-5736 – runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout
https://notcve.org/view.php?id=CVE-2019-5736
11 Feb 2019 — runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/sel... • https://packetstorm.news/files/id/165197 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 3.3EPSS: 0%CPEs: 9EXPL: 0CVE-2018-6556 – The lxc-user-nic component of LXC allows unprivileged users to open arbitrary files
https://notcve.org/view.php?id=CVE-2018-6556
06 Aug 2018 — lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). Affected releases are LXC: 2.0 versions above and including 2.0.9; 3.0 versions above and including 3.0.0, prior to 3.0.2. Cuando se solicita a lxc-user-nic ... • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html • CWE-417: Communication Channel Errors •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-5985 – Ubuntu Security Notice USN-3224-1
https://notcve.org/view.php?id=CVE-2017-5985
10 Mar 2017 — lxc-user-nic in Linux Containers (LXC) allows local users with a lxc-usernet allocation to create network interfaces on the host and choose the name of those interfaces by leveraging lack of netns ownership check. lxc-user-nic en Linux Containers (LXC) permite a usuarios locales con una asignación lxc-usernet crear interfaces de red en el host y elegir el nombre de esas interfaces aprovechando la falta de verificación de propiedad de netns. Jann Horn discovered that LXC incorrectly verified permissions when... • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html • CWE-862: Missing Authorization •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10124 – Gentoo Linux Security Advisory 201711-09
https://notcve.org/view.php?id=CVE-2016-10124
09 Jan 2017 — An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container. Se ha descubierto un problema en Linux Containers (LXC) en versiones anteriores a 22-02-2016. Cuando se ejecuta un programa a través de lxc-attach, la sesión no privada puede escapar a la sesión parental utilizando el ioctl... • http://www.openwall.com/lists/oss-security/2014/12/15/5 • CWE-284: Improper Access Control •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2016-8649 – Ubuntu Security Notice USN-3136-1
https://notcve.org/view.php?id=CVE-2016-8649
24 Nov 2016 — lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls. lxc-attach en LXC entre las versiones 1.0.9 y 2.x hasta la versión 2.0.6 permite que un atacante dentro de un contenedor sin privilegios, utilice un descriptor de archivo heredado de la carpeta /proc del host para acceder al resto del sistema de archivos del host a ... • http://www.securityfocus.com/bid/94498 • CWE-264: Permissions, Privileges, and Access Controls •