Linuxcontainers Lxc vulnerabilities

CVE-2019-5736 [HIGH] CWE-78 CVE-2019-5736: runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overw runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to whi

CVE-2016-8649 [CRITICAL] CWE-264 CVE-2016-8649: lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged con lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.

CVE-2016-10124 [HIGH] CWE-284 CVE-2016-10124: An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lx An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container.

CVE-2017-18641 [HIGH] CWE-287 CVE-2017-18641: In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature ch In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers.

CVE-2026-39402 [MEDIUM] CWE-863 CVE-2026-39402: lxc is a Linux container runtime. In the setuid helper lxc-user-nic, the delete path contains a logi lxc is a Linux container runtime. In the setuid helper lxc-user-nic, the delete path contains a logic flaw in the find_line() function that allows an unprivileged user to delete OVS-attached network interfaces belonging to other users. When lxc-user-nic delete scans its NIC database to authorize a deletion request, the interface name comparison can

CVE-2013-6441 [HIGH] CWE-264 CVE-2013-6441: The lxc-sshd template (templates/lxc-sshd.in) in LXC before 1.0.0.beta2 uses read-write permissions The lxc-sshd template (templates/lxc-sshd.in) in LXC before 1.0.0.beta2 uses read-write permissions when mounting /sbin/init, which allows local users to gain privileges by modifying the init file.

CVE-2015-1335 [HIGH] CWE-59 CVE-2015-1335: lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.

CVE-2015-1331 [MEDIUM] CWE-59 CVE-2015-1331: lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.

CVE-2015-1334 [MEDIUM] CWE-17 CVE-2015-1334: attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local contai attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local container users to escape AppArmor or SELinux confinement by mounting a proc filesystem with a crafted (1) AppArmor profile or (2) SELinux label.

CVE-2022-47952 [LOW] CVE-2022-47952: lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer wheth lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 b

CVE-2018-6556 [LOW] CWE-417 CVE-2018-6556: lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). A

CVE-2017-5985 [LOW] CWE-862 CVE-2017-5985: lxc-user-nic in Linux Containers (LXC) allows local users with a lxc-usernet allocation to create ne lxc-user-nic in Linux Containers (LXC) allows local users with a lxc-usernet allocation to create network interfaces on the host and choose the name of those interfaces by leveraging lack of netns ownership check.