attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local container users to escape AppArmor or SELinux confinement by mounting a proc filesystem with a crafted (1) AppArmor profile or (2) SELinux label.

This update for lxc, lxcfs to version 3.1.0 fixes the following issues :

Security issues fixed :

  - CVE-2019-5736: Fixed a container breakout vulnerability     (boo#1122185).

  - CVE-2018-6556: Enable setuid bit on lxc-user-nic     (boo#988348).

Non-security issues fixed :

  - Update to LXC 3.1.0. The changelog is far too long to     include here, please look at     https://linuxcontainers.org/. (boo#1131762)

Security fix for CVE-2015-1331, CVE-2015-1334.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Description of changes:

[1.0.7-2.0.7]
- [Orabug 21533491] CVE-2015-1334: Don't use the container's /proc during    attach

[1.0.7-2.0.6]
- [Orabug 21526922] CVE-2015-1331: LXCLOCK: USE /RUN/LXC/LOCK RATHER THAN    /RUN/LOCK/LXC

lxc was updated to fix one security issue.

The following vulnerability was fixed :

  - CVE-2015-1334: AppArmor or SELinux confinement escape     via fake /proc (bnc#938523)

lxc was updated to fix two security issues.

The following vulnerabilities were fixed :

  - CVE-2015-1331: directory traversal flaw allowing     arbitrary file creation as the root user (bnc#938522)

  - CVE-2015-1334: AppArmor or SELinux confinement escape     via fake /proc (bnc#938523)

Several vulnerabilities have been discovered in LXC, the Linux Containers userspace tools. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-1331     Roman Fiedler discovered a directory traversal flaw in     LXC when creating lock files. A local attacker could     exploit this flaw to create an arbitrary file as the     root user.

  - CVE-2015-1334     Roman Fiedler discovered that LXC incorrectly trusted     the container's proc filesystem to set up AppArmor     profile changes and SELinux domain transitions. A     malicious container could create a fake proc filesystem     and use this flaw to run programs inside the container     that are not confined by AppArmor or SELinux.

Roman Fiedler discovered that LXC had a directory traversal flaw when creating lock files. A local attacker could exploit this flaw to create an arbitrary file as the root user. (CVE-2015-1331)

Roman Fiedler discovered that LXC incorrectly trusted the container's proc filesystem to set up AppArmor profile changes and SELinux domain transitions. A local attacker could exploit this flaw to run programs inside the container that are not confined by AppArmor or SELinux.
(CVE-2015-1334).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
125668	openSUSE Security Update : lxc / lxcfs (openSUSE-2019-1481)	Nessus	SuSE Local Security Checks	high
85315	Fedora 22 : lxc-1.1.2-2.fc22 (2015-12647)	Nessus	Fedora Local Security Checks	medium
85314	Fedora 21 : lxc-1.0.7-2.fc21 (2015-12645)	Nessus	Fedora Local Security Checks	medium
85313	Fedora 23 : lxc-1.1.2-2.fc23 (2015-12608)	Nessus	Fedora Local Security Checks	medium
85178	Oracle Linux 6 / 7 : lxc (ELSA-2015-3065)	Nessus	Oracle Linux Local Security Checks	medium
85136	openSUSE Security Update : lxc (openSUSE-2015-524)	Nessus	SuSE Local Security Checks	medium
85135	openSUSE Security Update : lxc (openSUSE-2015-523)	Nessus	SuSE Local Security Checks	medium
84993	Debian DSA-3317-1 : lxc - security update	Nessus	Debian Local Security Checks	medium
84957	Ubuntu 14.04 LTS : LXC vulnerabilities (USN-2675-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2015-1334

critical

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

critical