// For flags

CVE-2018-6556

The lxc-user-nic component of LXC allows unprivileged users to open arbitrary files

Severity Score

3.3
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). Affected releases are LXC: 2.0 versions above and including 2.0.9; 3.0 versions above and including 3.0.0, prior to 3.0.2.

Cuando se solicita a lxc-user-nic que elimine una interfaz de red, abrirá de forma incondicional una ruta proporcionada por el usuario. Esta ruta de código podría ser empleada por un usuario sin privilegios para comprobar la existencia de una ruta que no hubiese podido alcanzar de otra forma. También podría emplearse para desencadenar efectos secundarios provocando la apertura (solo lectura) de archivos especiales del kernel (ptmx, proc, sys). Los productos afectados son LXC: desde la versión 2.0 hasta después de la la 2.0.9 (incluida) y desde la versión 3.0 hasta después de la 3.0.0, anterior a la 3.0.2.

*Credits: Matthias Gerstner from SUSE
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-02-02 CVE Reserved
  • 2018-08-06 CVE Published
  • 2023-08-04 EPSS Updated
  • 2024-09-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-417: Communication Channel Errors
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 18.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04"
lts
Affected
Linuxcontainers
Search vendor "Linuxcontainers"
 Lxc
Search vendor "Linuxcontainers" for product "Lxc"
 >= 2.0.0 <= 2.0.9
Search vendor "Linuxcontainers" for product "Lxc" and version " >= 2.0.0 <= 2.0.9"
-
Affected
Linuxcontainers
Search vendor "Linuxcontainers"
 Lxc
Search vendor "Linuxcontainers" for product "Lxc"
 >= 3.0.0 < 3.0.2
Search vendor "Linuxcontainers" for product "Lxc" and version " >= 3.0.0 < 3.0.2"
-
Affected
Suse
Search vendor "Suse"
 Caas Platform
Search vendor "Suse" for product "Caas Platform"
 1.0
Search vendor "Suse" for product "Caas Platform" and version "1.0"
-
Affected
Suse
Search vendor "Suse"
 Caas Platform
Search vendor "Suse" for product "Caas Platform"
 2.0
Search vendor "Suse" for product "Caas Platform" and version "2.0"
-
Affected
Suse
Search vendor "Suse"
 Openstack Cloud
Search vendor "Suse" for product "Openstack Cloud"
 6
Search vendor "Suse" for product "Openstack Cloud" and version "6"
-
Affected
Suse
Search vendor "Suse"
 Suse Linux Enterprise Server
Search vendor "Suse" for product "Suse Linux Enterprise Server"
 11
Search vendor "Suse" for product "Suse Linux Enterprise Server" and version "11"
sp3, ltss
Affected
Suse
Search vendor "Suse"
 Suse Linux Enterprise Server
Search vendor "Suse" for product "Suse Linux Enterprise Server"
 11
Search vendor "Suse" for product "Suse Linux Enterprise Server" and version "11"
sp4
Affected
Opensuse
Search vendor "Opensuse"
 Leap
Search vendor "Opensuse" for product "Leap"
 15.0
Search vendor "Opensuse" for product "Leap" and version "15.0"
-
Affected