Lucene search

[email protected]NVD:CVE-2018-6556

HistoryAug 10, 2018 - 3:29 p.m.

CVE-2018-6556

2018-08-1015:29:01

CWE-417

[email protected]

web.nvd.nist.gov

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

33.6%

JSON

lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn’t otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). Affected releases are LXC: 2.0 versions above and including 2.0.9; 3.0 versions above and including 3.0.0, prior to 3.0.2.

Affected configurations

Nvd

Node

canonicalubuntu_linuxMatch18.04lts

Node

linuxcontainerslxcRange2.0.0–2.0.9

linuxcontainerslxcRange3.0.0–3.0.2

Node

susecaas_platformMatch1.0

susecaas_platformMatch2.0

suseopenstack_cloudMatch6

susesuse_linux_enterprise_serverMatch11sp3ltss

susesuse_linux_enterprise_serverMatch11sp4

Node

opensuseleapMatch15.0

VendorProductVersionCPE
canonicalubuntu_linux18.04cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
linuxcontainerslxc*cpe:2.3:a:linuxcontainers:lxc:*:*:*:*:*:*:*:*
susecaas_platform1.0cpe:2.3:a:suse:caas_platform:1.0:*:*:*:*:*:*:*
susecaas_platform2.0cpe:2.3:a:suse:caas_platform:2.0:*:*:*:*:*:*:*
suseopenstack_cloud6cpe:2.3:a:suse:openstack_cloud:6:*:*:*:*:*:*:*
susesuse_linux_enterprise_server11cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp3:*:*:ltss:*:*:*
susesuse_linux_enterprise_server11cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp4:*:*:*:*:*:*
opensuseleap15.0cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
canonical	ubuntu_linux	18.04	cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
linuxcontainers	lxc	*	cpe:2.3:a:linuxcontainers:lxc::::::::
suse	caas_platform	1.0	cpe:2.3:a:suse:caas_platform:1.0:::::::*
suse	caas_platform	2.0	cpe:2.3:a:suse:caas_platform:2.0:::::::*
suse	openstack_cloud	6	cpe:2.3:a:suse:openstack_cloud:6:::::::*
suse	suse_linux_enterprise_server	11	cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp3:::ltss:::*
suse	suse_linux_enterprise_server	11	cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp4::::::
opensuse	leap	15.0	cpe:2.3:o:opensuse:leap:15.0:::::::*