[SECURITY] [DLA 442-1] lxc security update

2016-02-2914:41:59

lists.debian.org

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

27.3%

JSON

Package : lxc
Version : 0.7.2-1+deb6u1
CVE ID : CVE-2013-6441 CVE-2015-1335
Debian Bug : #800471

Brief introduction

CVE-2013-6441

The template script lxc-sshd used to mount itself as /sbin/init in the
container using a writable bind-mount.

This update resolved the above issue by using a read-only bind-mount
instead preventing any form of potentially accidental damage.

CVE-2015-1335

On container startup, lxc sets up the container&#x27;s initial file system
tree by doing a bunch of mounting, guided by the container&#x27;s configuration
file.

The container config is owned by the admin or user on the host, so we
do not try to guard against bad entries. However, since the mount
target is in the container, it&#x27;s possible that the container admin
could divert the mount with symbolic links. This could bypass proper
container startup (i.e. confinement of a root-owned container by the
restrictive apparmor policy, by diverting the required write to
/proc/self/attr/current), or bypass the (path-based) apparmor policy
by diverting, say, /proc to /mnt in the container.

This update implements a safe_mount() function that prevents lxc from
doing mounts onto symbolic links.

–

mike gabriel aka sunweaver (Debian Developer)
fon: +49 (1520) 1976 148

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31
mail: [email protected], http://sunweavers.net
Attachment:
signature.asc
Description: Digital signature

OSVersionArchitecturePackageVersionFilename
Debian8powerpclxc< 1:1.0.6-6+deb8u2lxc_1:1.0.6-6+deb8u2_powerpc.deb
Debian8armellxc-dbg< 1:1.0.6-6+deb8u2lxc-dbg_1:1.0.6-6+deb8u2_armel.deb
Debian8amd64lxc-dbg< 1:1.0.6-6+deb8u2lxc-dbg_1:1.0.6-6+deb8u2_amd64.deb
Debian8mipsellxc< 1:1.0.6-6+deb8u2lxc_1:1.0.6-6+deb8u2_mipsel.deb
Debian8armhflxc< 1:1.0.6-6+deb8u2lxc_1:1.0.6-6+deb8u2_armhf.deb
Debian8i386lxc< 1:1.0.6-6+deb8u2lxc_1:1.0.6-6+deb8u2_i386.deb
Debian8arm64lxc< 1:1.0.6-6+deb8u2lxc_1:1.0.6-6+deb8u2_arm64.deb
Debian8alllxc< 1:1.0.6-6+deb8u2lxc_1:1.0.6-6+deb8u2_all.deb
Debian6alllxc< 0.7.2-1+deb6u1lxc_0.7.2-1+deb6u1_all.deb
Debian8mipslxc-dbg< 1:1.0.6-6+deb8u2lxc-dbg_1:1.0.6-6+deb8u2_mips.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	powerpc	lxc	< 1:1.0.6-6+deb8u2	lxc_1:1.0.6-6+deb8u2_powerpc.deb
Debian	8	armel	lxc-dbg	< 1:1.0.6-6+deb8u2	lxc-dbg_1:1.0.6-6+deb8u2_armel.deb
Debian	8	amd64	lxc-dbg	< 1:1.0.6-6+deb8u2	lxc-dbg_1:1.0.6-6+deb8u2_amd64.deb
Debian	8	mipsel	lxc	< 1:1.0.6-6+deb8u2	lxc_1:1.0.6-6+deb8u2_mipsel.deb
Debian	8	armhf	lxc	< 1:1.0.6-6+deb8u2	lxc_1:1.0.6-6+deb8u2_armhf.deb
Debian	8	i386	lxc	< 1:1.0.6-6+deb8u2	lxc_1:1.0.6-6+deb8u2_i386.deb
Debian	8	arm64	lxc	< 1:1.0.6-6+deb8u2	lxc_1:1.0.6-6+deb8u2_arm64.deb
Debian	8	all	lxc	< 1:1.0.6-6+deb8u2	lxc_1:1.0.6-6+deb8u2_all.deb
Debian	6	all	lxc	< 0.7.2-1+deb6u1	lxc_0.7.2-1+deb6u1_all.deb
Debian	8	mips	lxc-dbg	< 1:1.0.6-6+deb8u2	lxc-dbg_1:1.0.6-6+deb8u2_mips.deb