attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local container users to escape AppArmor or SELinux confinement by mounting a proc filesystem with a crafted (1) AppArmor profile or (2) SELinux label.

This update for lxc, lxcfs to version 3.1.0 fixes the following issues :

Security issues fixed :

  - CVE-2019-5736: Fixed a container breakout vulnerability     (boo#1122185).

  - CVE-2018-6556: Enable setuid bit on lxc-user-nic     (boo#988348).

Non-security issues fixed :

  - Update to LXC 3.1.0. The changelog is far too long to     include here, please look at     https://linuxcontainers.org/. (boo#1131762)

Security fix for CVE-2015-1331, CVE-2015-1334.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3065 advisory.

    - [Orabug 21533491] CVE-2015-1334: Don't use the container's /proc during       attach

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

lxc was updated to fix one security issue.

The following vulnerability was fixed :

  - CVE-2015-1334: AppArmor or SELinux confinement escape     via fake /proc (bnc#938523)

lxc was updated to fix two security issues.

The following vulnerabilities were fixed :

  - CVE-2015-1331: directory traversal flaw allowing     arbitrary file creation as the root user (bnc#938522)

  - CVE-2015-1334: AppArmor or SELinux confinement escape     via fake /proc (bnc#938523)

Several vulnerabilities have been discovered in LXC, the Linux Containers userspace tools. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-1331     Roman Fiedler discovered a directory traversal flaw in     LXC when creating lock files. A local attacker could     exploit this flaw to create an arbitrary file as the     root user.

  - CVE-2015-1334     Roman Fiedler discovered that LXC incorrectly trusted     the container's proc filesystem to set up AppArmor     profile changes and SELinux domain transitions. A     malicious container could create a fake proc filesystem     and use this flaw to run programs inside the container     that are not confined by AppArmor or SELinux.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2675-1 advisory.

    Roman Fiedler discovered that LXC had a directory traversal flaw when creating lock files. A local     attacker could exploit this flaw to create an arbitrary file as the root user. (CVE-2015-1331)

    Roman Fiedler discovered that LXC incorrectly trusted the container's proc filesystem to set up AppArmor     profile changes and SELinux domain transitions. A local attacker could exploit this flaw to run programs     inside the container that are not confined by AppArmor or SELinux. (CVE-2015-1334)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
125668	openSUSE Security Update : lxc / lxcfs (openSUSE-2019-1481)	Nessus	SuSE Local Security Checks	high
85315	Fedora 22 : lxc-1.1.2-2.fc22 (2015-12647)	Nessus	Fedora Local Security Checks	medium
85314	Fedora 21 : lxc-1.0.7-2.fc21 (2015-12645)	Nessus	Fedora Local Security Checks	medium
85313	Fedora 23 : lxc-1.1.2-2.fc23 (2015-12608)	Nessus	Fedora Local Security Checks	medium
85178	Oracle Linux 6 / 7 : lxc (ELSA-2015-3065)	Nessus	Oracle Linux Local Security Checks	medium
85136	openSUSE Security Update : lxc (openSUSE-2015-524)	Nessus	SuSE Local Security Checks	medium
85135	openSUSE Security Update : lxc (openSUSE-2015-523)	Nessus	SuSE Local Security Checks	medium
84993	Debian DSA-3317-1 : lxc - security update	Nessus	Debian Local Security Checks	medium
84957	Ubuntu 14.04 LTS : LXC vulnerabilities (USN-2675-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2015-1334

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium