CVE-2015-1340

Published: Apr 22, 2019Modified: Nov 21, 2024

8.1

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.

Affected Products (1)

CPE details will appear after the next data sync.

Linuxcontainers

1 product

Lxd

References (2)

https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4

Source: security@ubuntu.com

PatchThird Party Advisory

https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.