Kurz gesagt
- CVE-2015-1340 ist eine Schwachstelle (HOCH (CVSS 8.1)) in github.com/lxc/lxd.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.90%, höher als bei 59.6% aller Schwachstellen.
- Abhilfe: auf 0.0.0-20151004155856-19c6961cc101 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| github.com/lxc/lxd Go | < 0.0.0-20151004155856-19c6961cc101
| 0.0.0-20151004155856-19c6961cc101
|
Description
LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
Specific Go Packages Affected
github.com/lxc/lxd/shared
NVD description
LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free