CVE-2015-1335

Published: Oct 1, 2015Modified: May 6, 2026

7.2

Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.

Affected (7)

Products: Linuxcontainers: Lxc · Canonical: Ubuntu Linux

Linuxcontainers

1 product

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Linuxcontainers Lxc	Up to 1.0.7
Linuxcontainers Lxc	Version 1.1.0
Linuxcontainers Lxc	Version 1.1.1
Linuxcontainers Lxc	Version 1.1.2
Linuxcontainers Lxc	Version 1.1.3

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.04

Related CWEs

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (26)

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170045.html

Source: security@ubuntu.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171358.html

Source: security@ubuntu.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171364.html

Source: security@ubuntu.com

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html

Source: security@ubuntu.com

http://lists.opensuse.org/opensuse-updates/2015-10/msg00023.html

Source: security@ubuntu.com

http://www.debian.org/security/2015/dsa-3400

Source: security@ubuntu.com

http://www.openwall.com/lists/oss-security/2015/09/29/4

Source: security@ubuntu.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: security@ubuntu.com

http://www.securityfocus.com/bid/76894

Source: security@ubuntu.com

http://www.ubuntu.com/usn/USN-2753-1

Source: security@ubuntu.com

https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1476662

Source: security@ubuntu.com

https://github.com/lxc/lxc/commit/592fd47a6245508b79fe6ac819fe6d3b2c1289be

Source: security@ubuntu.com

https://lists.linuxcontainers.org/pipermail/lxc-devel/2015-September/012434.html

Source: security@ubuntu.com

PatchVendor Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170045.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171358.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171364.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2015-10/msg00023.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2015/dsa-3400

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2015/09/29/4

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/76894

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2753-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1476662

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/lxc/lxc/commit/592fd47a6245508b79fe6ac819fe6d3b2c1289be

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.linuxcontainers.org/pipermail/lxc-devel/2015-September/012434.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.