PT-2019-7169 · Canonical · Lxd

Seth Arnold · Published 2019-04-22 · Updated 2022-05-24 · CVE-2015-1340

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LXD versions prior to 0.19-0ubuntu5

Description The issue arises from a race condition between chown and chmod operations during a container filesystem shift. This could allow an attacker to change the mode of any file on the system, rather than the expected path, by creating a symbolic link in a specific window. The doUidshiftIntoContainer() function has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function.

Recommendations For versions prior to 0.19-0ubuntu5, update to version 0.19-0ubuntu5 or later to resolve the issue. As a temporary workaround, consider restricting access to the doUidshiftIntoContainer() function until a patch is available. Avoid using the Chmod() call in the affected Filepath.Walk() function until the issue is resolved.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2015-1340

GHSA-8MPQ-FMR3-6JXV

GO-2021-0071

Affected Products

Lxd

References · 8

• https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4 · Patch
• https://osv.dev/vulnerability/GHSA-8mpq-fmr3-6jxv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1340 · Security Note
• https://osv.dev/vulnerability/GO-2021-0071 · Vendor Advisory
• https://github.com/lxc/lxd · Note
• https://github.com/lxc/lxd/pull/1189 · Note
• https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/1502270 · Note
• https://pkg.go.dev/vuln/GO-2021-0071 · Note