Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 493
Alerts This Week
Warning Icon 1 493

Ubuntu 16.10: USN-3224-1 Critical LXC Network Interface Issue

ubuntu
Calendar Grey March 9, 2017
Dist Ubuntu Esm H88
A new patch for LXC on Ubuntu has been released to rectify a permissions-related problem encountered during the establishment of virtual network interfaces.
LXC could be made to create arbitrary virtual network interfaces as anadministrator.

Summary

LXC could be made to create arbitrary virtual network interfaces as an

administrator.

Software Description:

- lxc: Linux Containers userspace tools

Details:

Jann Horn discovered that LXC incorrectly verified permissions when creating

virtual network interfaces. A local attacker could possibly use this issue to

create virtual network interfaces in network namespaces that they do not own.

Topics%20covered

Topics Covered

security advisory critical Ubuntu permissions issue attack vector network interface LXC

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  lxc-common                      2.0.7-0ubuntu1~16.10.2

Ubuntu 16.04 LTS:
  lxc-common                      2.0.7-0ubuntu1~16.04.2

Ubuntu 14.04 LTS:
  lxc                             1.0.9-0ubuntu3

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-3224-1

CVE-2017-5985

Severity
critical
Lowest
Low
Medium
High
Critical

March 09, 2017

Topics%20covered

Topics Covered

security advisory critical Ubuntu permissions issue attack vector network interface LXC

Package Information

https://launchpad.net/ubuntu/+source/lxc/2.0.7-0ubuntu1~16.10.2
https://launchpad.net/ubuntu/+source/lxc/2.0.7-0ubuntu1~16.04.2
https://launchpad.net/ubuntu/+source/lxc/1.0.9-0ubuntu3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.