CVE-2018-6556

lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). Affected releases are LXC: 2.0 versions above and including 2.0.9; 3.0 versions above and including 3.0.0, prior to 3.0.2.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
canonicalCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 12%
VendorProductVersion
canonicalubuntu_linux
18.04
linuxcontainerslxc
2.0.0 ≤
𝑥
≤ 2.0.9
linuxcontainerslxc
3.0.0 ≤
𝑥
< 3.0.2
susecaas_platform
1.0
susecaas_platform
2.0
opensuseleap
15.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
lxc
bullseye
1:4.0.6-2+deb11u2
fixed
stretch
not-affected
jessie
not-affected
bookworm
1:5.0.2-1+deb12u2
fixed
sid
1:6.0.2-1
fixed
trixie
1:6.0.2-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
lxc
bionic
Fixed 3.0.1-0ubuntu1~18.04.2
released
xenial
not-affected
trusty
not-affected
Common Weakness Enumeration