Bug 1615630 (CVE-2018-6556)

Summary:	CVE-2018-6556 lxc: lxc-user-nic allows for open() of arbitrary paths
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	admiller, karlthered, pokorra.mailinglists, sagarun, silas, thomas.moschny
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	lxc 3.0.2	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:35:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1615631
Bug Blocks:

Description Laura Pardo 2018-08-13 22:34:48 UTC

A flaw was found in lxc-user-nic 2.0 versions above and including 2.0.9; 3.0 versions above and including 3.0.0, prior to 3.0.2. . When asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys).


References:
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1783591
https://bugzilla.suse.com/show_bug.cgi?id=988348

Upstream Patches:
- stable-2.0: https://github.com/lxc/lxc/commit/5eb45428b312e978fb9e294dde16efb14dd9fa4d 
- stable-3.0: https://github.com/lxc/lxc/commit/c1cf54ebf251fdbad1e971679614e81649f1c032 
- master: https://github.com/lxc/lxc/commit/f26dc127bf5d66e8c29f8584c64bd97c9bbbc574

Comment 1 Laura Pardo 2018-08-13 22:35:16 UTC

Created lxc tracking bugs for this issue:

Affects: fedora-all [bug 1615631]

Comment 2 Product Security DevOps Team 2019-06-10 10:35:42 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.