lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.

This update for lxc, lxcfs to version 3.1.0 fixes the following issues :

Security issues fixed :

  - CVE-2019-5736: Fixed a container breakout vulnerability     (boo#1122185).

  - CVE-2018-6556: Enable setuid bit on lxc-user-nic     (boo#988348).

Non-security issues fixed :

  - Update to LXC 3.1.0. The changelog is far too long to     include here, please look at     https://linuxcontainers.org/. (boo#1131762)

lxc-1.0.7-4.fc21 - Add some patches: - Allow building on EPEL6. - Fix boot-order (similar to rhbz#1263612). - Prevent lxc-top crash ( rhbz#1152384 ). - Set lxc.kmsg = 0 in the config ( rhbz#1204389 ). - Use 'overlay' as fs name when needed ( rhbz#1217516 ). - Add dependency on rsync ( rhbz#1177981 ).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update LXC to the latest stable release. The full list of changes can be found [here](https://linuxcontainers.org/lxc/news/#lxc-114-release-announcem ent6th-of- october-2015).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Brief introduction 

CVE-2013-6441

The template script lxc-sshd used to mount itself as /sbin/init in the container using a writable bind-mount.

This update resolved the above issue by using a read-only bind-mount instead preventing any form of potentially accidental damage.

CVE-2015-1335

On container startup, lxc sets up the container's initial file system tree by doing a bunch of mounting, guided by the container's configuration file.

The container config is owned by the admin or user on the host, so we do not try to guard against bad entries.
However, since the mount target is in the container, it's possible that the container admin could divert the mount with symbolic links. This could bypass proper container startup (i.e. confinement of a root-owned container by the restrictive apparmor policy, by diverting the required write to /proc/self/attr/current), or bypass the (path-based) apparmor policy by diverting, say, /proc to /mnt in the container.

This update implements a safe_mount() function that prevents lxc from doing mounts onto symbolic links.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Roman Fiedler discovered a directory traversal flaw in LXC, the Linux Containers userspace tools. A local attacker with access to a LXC container could exploit this flaw to run programs inside the container that are not confined by AppArmor or expose unintended files in the host to the container.

lxc was update to fix one security issue.

The following vulnerability was fixed :

  - CVE-2015-1335: A directory traversal flaw while     lxc-start is initially setting up the mounts for a     container (bsc#946744)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Description of changes:

[1.0.7-2.0.12]
- [Orabug 22011867] ol6 ct shutdown script remounts /dev/pts/* devices as    ro on host system.

[1.0.7-2.0.11]
- [Orabug 21842483] failed to create directory '/RUN/LXC/LOCK//CONTAINER/OL7.1/SNAPS'
- CVE-2015-1335: Protect container mounts against symlinks.
- Fixed build failure on OL6.

lxc was update to fix one security issue.

The following vulnerability was fixed :

  - CVE-2015-1335: A directory traversal flaw while     lxc-start is initially setting up the mounts for a     container (boo#946744)

Roman Fiedler discovered a directory traversal flaw in lxc-start. A local attacker with access to an LXC container could exploit this flaw to run programs inside the container that are not confined by AppArmor or expose unintended files in the host to the container.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
125668	openSUSE Security Update : lxc / lxcfs (openSUSE-2019-1481)	Nessus	SuSE Local Security Checks	high
89448	Fedora 21 : lxc-1.0.7-4.fc21 (2015-ebfe46536f)	Nessus	Fedora Local Security Checks	high
89340	Fedora 23 : lxc-1.1.4-2.fc23 (2015-9f8f4b182a)	Nessus	Fedora Local Security Checks	high
89174	Fedora 22 : lxc-1.1.4-2.fc22 (2015-211974138f)	Nessus	Fedora Local Security Checks	high
89042	Debian DLA-442-1 : lxc security update	Nessus	Debian Local Security Checks	high
86954	Debian DSA-3400-1 : lxc - security update	Nessus	Debian Local Security Checks	high
86628	SUSE SLED11 / SLES11 Security Update : lxc (SUSE-SU-2015:1829-1)	Nessus	SuSE Local Security Checks	high
86438	Oracle Linux 6 / 7 : lxc (ELSA-2015-3087)	Nessus	Oracle Linux Local Security Checks	high
86337	openSUSE Security Update : lxc (openSUSE-2015-648)	Nessus	SuSE Local Security Checks	high
86208	Ubuntu 14.04 LTS : LXC vulnerability (USN-2753-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2015-1335

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high