PT-2018-3455 · Linux Containers+3 · Lxc+3

Matthias Gerstner · Published 2017-09-07 · Updated 2025-04-10 · CVE-2018-6556

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: LXC versions 2.0.9 and above LXC versions 3.0.0 and above, prior to 3.0.2

Description: The issue is related to the lxc-user-nic when deleting a network interface, which unconditionally opens a user-provided path. This can be used by an unprivileged user to check for the existence of a path they wouldn't otherwise be able to reach. It may also trigger side effects by causing a read-only open of special kernel files, such as ptmx, proc, and sys.

Recommendations: For LXC versions 2.0.9 and above, update to a version prior to the affected range or apply a patch if available. For LXC versions 3.0.0 and above, prior to 3.0.2, update to version 3.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the lxc-user-nic functionality to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-417

Related Identifiers

ALT-PU-2017-2154

ALT-PU-2018-2293

BDU:2020-01714

CVE-2018-6556

OPENSUSE-SU-2018_2316-1

OPENSUSE-SU-2019:1227-1

OPENSUSE-SU-2019:1230-1

OPENSUSE-SU-2019:1275-1

OPENSUSE-SU-2019_1275-1

OPENSUSE-SU-2019_1481-1

OPENSUSE-SU-2024:11030-1

USN-3730-1

Affected Products

Alt Linux

Lxc

Suse

Ubuntu

References · 72

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_runc_escape.rb · Exploit
• 🔥 https://github.com/Frichetten/CVE-2019-5736-PoC · Exploit
• 🔥 https://github.com/feexd/pocs/blob/master/CVE-2019-5736/exploit.c · Exploit
• 🔥 https://github.com/q3k/cve-2019-5736-poc · Exploit
• 🔥 https://github.com/twistlock/RunC-CVE-2019-5736 · Exploit
• 🔥 https://github.com/jas502n/CVE-2019-5736 · Exploit
• 🔥 https://github.com/agppp/cve-2019-5736-poc · Exploit
• https://cve.org/CVERecord?id=CVE-2018-6556 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-6556 · Vendor Advisory
• https://usn.ubuntu.com/usn/usn-3730-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11030-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-6556 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1227-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-6556 · Vendor Advisory