lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). Affected releases are LXC: 2.0 versions above and including 2.0.9; 3.0 versions above and including 3.0.0, prior to 3.0.2.

This update for lxc, lxcfs to version 3.1.0 fixes the following issues :

Security issues fixed :

  - CVE-2019-5736: Fixed a container breakout vulnerability     (boo#1122185).

  - CVE-2018-6556: Enable setuid bit on lxc-user-nic     (boo#988348).

Non-security issues fixed :

  - Update to LXC 3.1.0. The changelog is far too long to     include here, please look at     https://linuxcontainers.org/. (boo#1131762)

This update for lxc fixes the following issues :

The following security vulnerability was fixed :

  - CVE-2018-6556: Fixed an information leak and possible     open() side effects to regular users via lxc-user-nic     (boo#988348)

The remote host is affected by the vulnerability described in GLSA-201808-02 (LinuX Containers user space utilities: Arbitrary file read)

    lxc-user-nic when asked to delete a network interface will       unconditionally open a user provided path. This code path may be used by       an unprivileged user to check for the existence of a path which they       wouldn&rsquo;t otherwise be able to reach.
  Impact :

    A local unprivileged user could use this flaw to access arbitrary files,       including special device files.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3730-1 advisory.

    Matthias Gerstner discovered that LXC incorrectly handled the lxc-user-nic utility. A local attacker could     possibly use this issue to open arbitrary files.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
125668	openSUSE Security Update : lxc / lxcfs (openSUSE-2019-1481)	Nessus	SuSE Local Security Checks	high
124312	openSUSE Security Update : lxc / lxcfs (openSUSE-2019-1275)	Nessus	SuSE Local Security Checks	high
123259	openSUSE Security Update : lxc (openSUSE-2019-596)	Nessus	SuSE Local Security Checks	low
112076	GLSA-201808-02 : LinuX Containers user space utilities: Arbitrary file read	Nessus	Gentoo Local Security Checks	low
111739	openSUSE Security Update : lxc (openSUSE-2018-865)	Nessus	SuSE Local Security Checks	low
111577	Ubuntu 18.04 LTS : LXC vulnerability (USN-3730-1)	Nessus	Ubuntu Local Security Checks	low

Detections

Analytics

CVE-2018-6556

low

Tenable Plugins

high

high

low

low

low

low