Information disclosure in LXS - CVE-2018-6556

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU14510

Information disclosure in LXS - CVE-2018-6556

Published: August 23, 2018


Vulnerability identifier: #VU14510
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-6556
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local unauthenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to lxc-user-nic unconditionally opens a user provided path when asked to delete a network interface. A local attacker can check for the existence of a path which he wouldn't otherwise be able to reach and trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys).

Affected software

LXS
Gentoo Linux
Opensuse
SUSE Linux
openEuler
lxc (Alpine package)
lxc-help
lxc-debuginfo
lxc-debugsource
lxc-libs
lxc-devel
lxc

How to mitigate CVE-2018-6556

Update to version 3.0.2.

LXS - update to 3.0.2
lxc (Alpine package) - update to 2.0.9-r1
lxc-help - update to 4.0.3-2022102408
lxc-debuginfo - update to 4.0.3-2022102408
lxc-debugsource - update to 4.0.3-2022102408
lxc-libs - update to 4.0.3-2022102408
lxc-devel - update to 4.0.3-2022102408
lxc - update to 4.0.3-2022102408

External References

Related Security Bulletins