UbuntuUSN-2988-1LXD vulnerabilities
2.1 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
5.3 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
5.1%
Releases
- Ubuntu 16.04 ESM
- Ubuntu 15.10
Packages
- lxd - Container hypervisor based on LXC
Details
Robie Basak discovered that LXD incorrectly set permissions when setting up
a loop based ZFS pool. A local attacker could use this issue to copy and
read the data of any LXD container. (CVE-2016-1581)
Robie Basak discovered that LXD incorrectly set permissions when switching
an unprivileged container into privileged mode. A local attacker could use
this issue to access any world readable path in the container directory,
including setuid binaries. (CVE-2016-1582)
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 16.04 | noarch | lxd | < 2.0.2-0ubuntu1~16.04.1 | UNKNOWN |
| Ubuntu | 16.04 | noarch | golang-github-lxc-lxd-dev | < 2.0.2-0ubuntu1~16.04.1 | UNKNOWN |
| Ubuntu | 16.04 | noarch | lxc2 | < 2.0.2-0ubuntu1~16.04.1 | UNKNOWN |
| Ubuntu | 16.04 | noarch | lxd-client | < 2.0.2-0ubuntu1~16.04.1 | UNKNOWN |
| Ubuntu | 16.04 | noarch | lxd-client-dbgsym | < 2.0.2-0ubuntu1~16.04.1 | UNKNOWN |
| Ubuntu | 16.04 | noarch | lxd-dbgsym | < 2.0.2-0ubuntu1~16.04.1 | UNKNOWN |
| Ubuntu | 16.04 | noarch | lxd-tools | < 2.0.2-0ubuntu1~16.04.1 | UNKNOWN |
| Ubuntu | 16.04 | noarch | lxd-tools-dbgsym | < 2.0.2-0ubuntu1~16.04.1 | UNKNOWN |
| Ubuntu | 15.10 | noarch | lxd | < 0.20-0ubuntu4.2 | UNKNOWN |
| Ubuntu | 15.10 | noarch | lxd-client | < 0.20-0ubuntu4.2 | UNKNOWN |
Related
2.1 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
5.3 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
5.1%