Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu 18.04 & 16.04 USN-6738-1 Moderate: LXD Integrity Bypass

ubuntu
Calendar Grey April 22, 2024
Dist Ubuntu Esm H88
Critical flaw detected in LXD affects Ubuntu 16.04 and 18.04 LTS; please prioritize your updates now.
LXD could be made to bypass integrity checks if it received specially crafted input.

Summary

LXD could be made to bypass integrity checks if it received specially crafted

input.

Software Description:

- lxd: Container hypervisor based on LXC

Details:

Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that LXD

incorrectly handled the handshake phase and the use of sequence numbers in SSH

Binary Packet Protocol (BPP). If a user or an automated system were tricked

into opening a specially crafted input file, a remote attacker could possibly

use this issue to bypass integrity checks.

Topics%20covered

Topics Covered

security advisory remote attack ubuntu lxd integrity bypass lxd-client lxd-tools

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
   lxd                             3.0.3-0ubuntu1~18.04.2+esm1
   lxd-client                      3.0.3-0ubuntu1~18.04.2+esm1
   lxd-tools                       3.0.3-0ubuntu1~18.04.2+esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
   golang-github-lxc-lxd-dev       2.0.11-0ubuntu1~16.04.4+esm1
   lxc2                            2.0.11-0ubuntu1~16.04.4+esm1
   lxd                             2.0.11-0ubuntu1~16.04.4+esm1
   lxd-client                      2.0.11-0ubuntu1~16.04.4+esm1
   lxd-tools                       2.0.11-0ubuntu1~16.04.4+esm1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6738-1

CVE-2023-48795

Severity
important
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6738-1

Topics%20covered

Topics Covered

security advisory remote attack ubuntu lxd integrity bypass lxd-client lxd-tools

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here