CVE-2015-1340

LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.

CVSS v3 8.1 HIGH
CVSS v2.0 6.8 MEDIUM

8.1^/10

CVSS v3 : HIGH

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxcontainers:lxd:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-04-22 16:29

Updated : 2024-02-28 17:08

NVD link : CVE-2015-1340

Mitre link : CVE-2015-1340

CVE.ORG link : CVE-2015-1340

JSON object : View

Products Affected

linuxcontainers

lxd

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2015-1340", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.0, "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 0.4}]}, "published": "2019-04-22T16:29:00.897", "references": [{"url": "https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4", "tags": ["Patch", "Third Party Advisory"], "source": "security@ubuntu.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice."}, {"lang": "es", "value": "LXD anterior a la versi\u00f3n 0,19-0ubuntu5 la funci\u00f3n doUidshiftIntoContainer() presenta una llamada no segura chmod() que corre contra la STAT en la funci\u00f3n FilePath.Walk(). Un enlace simb\u00f3lico creado en esa ventana podr\u00eda hacer que cualquier archivo en el sistema tuviera cualquier modo de elecci\u00f3n del atacante."}], "lastModified": "2019-10-09T23:13:11.830", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxcontainers:lxd:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CA5DE4F-5C5D-4013-B838-F9A0548AD004"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}