Lucene search

CanonicalCVE-2016-1582

HistoryJun 09, 2016 - 4:59 p.m.

CVE-2016-1582

2016-06-0916:59:03

CWE-200

canonical

web.nvd.nist.gov

lxd

cve-2016-1582

container security

permission vulnerability

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

Percentile

5.1%

JSON

LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary world readable paths in the container directory via unspecified vectors.

Affected configurations

Nvd

Node

canonicalubuntu_linuxMatch15.10

canonicalubuntu_linuxMatch16.04lts

Node

canonicallxdMatch2.0.1

VendorProductVersionCPE
canonicalubuntu_linux15.10cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
canonicalubuntu_linux16.04cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
canonicallxd2.0.1cpe:2.3:a:canonical:lxd:2.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
canonical	ubuntu_linux	15.10	cpe:2.3:o:canonical:ubuntu_linux:15.10:::::::*
canonical	ubuntu_linux	16.04	cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
canonical	lxd	2.0.1	cpe:2.3:a:canonical:lxd:2.0.1:::::::*