Multiple security issues were discovered in LXD, a system container and virtual machine manager, which could result in denial of service. For the oldstable distribution (bookworm), these problems have been fixed in version 5.0.2-5+deb12u6. For the stable distribution (trixie), these problems have been fixed in. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6247-1
Multiple security issues were discovered in LXD, a system container and virtual machine manager, which could result in privilege escalation or the execution of arbitrary commands. For the oldstable distribution (bookworm), these problems have been fixed in version 5.0.2-5+deb12u4.. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6188-1
Two security issues were discovered in LXD, a system container and virtual machine manager, which could result the in execution of arbitrary commands via malformed images. For the oldstable distribution (bookworm), these problems have been fixed in version 5.0.2-5+deb12u3.. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6153-1
It was discovered that LXD, a system container and virtual machine manager, is prone to a local privilege escalation vulnerability if unprivileged users are allowed to access LXD through lxd-user. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-6057-1
An update that solves one vulnerability can now be installed.. # lxd-5.21.1-2.1 on GA media Announcement ID: openSUSE-SU-2024:14564-1 Rating: moderate Cross-References: * CVE-2023-46565 CVSS scores: * CVE-2023-46565 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the lxd-5.21.1-2.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * lxd 5.21.1-2.1 * lxd-bash-completion 5.21.1-2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-46565.html . OpenSUSE Notification for lxd-5.21.1-2.1 concerning a significant security vulnerability and essential update information.. openSUSE, lxd-5, moderate severity, security update, advisory. . LinuxSecurity.com Team
LXD could be made to bypass integrity checks if it received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-6738-1 April 22, 2024 lxd vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) Summary: LXD could be made to bypass integrity checks if it received specially crafted input. Software Description: - lxd: Container hypervisor based on LXC Details: Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that LXD incorrectly handled the handshake phase and the use of sequence numbers in SSH Binary Packet Protocol (BPP). If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to bypass integrity checks. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS (Available with Ubuntu Pro): lxd 3.0.3-0ubuntu1~18.04.2+esm1 lxd-client 3.0.3-0ubuntu1~18.04.2+esm1 lxd-tools 3.0.3-0ubuntu1~18.04.2+esm1 Ubuntu 16.04 LTS (Available with Ubuntu Pro): golang-github-lxc-lxd-dev 2.0.11-0ubuntu1~16.04.4+esm1 lxc2 2.0.11-0ubuntu1~16.04.4+esm1 lxd 2.0.11-0ubuntu1~16.04.4+esm1 lxd-client 2.0.11-0ubuntu1~16.04.4+esm1 lxd-tools 2.0.11-0ubuntu1~16.04.4+esm1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6738-1 CVE-2023-48795 . Critical flaw detected in LXD affects Ubuntu 16.04 and 18.04 LTS; please prioritize your updates now.. LXD Security Advisory,Ubuntu Integrity Bypass, Remote Attack Patch. . Severity: Important. LinuxSecurity.com Team
Several security issues were fixed in LXD.. =========================================================================Ubuntu Security Notice USN-2988-1 May 31, 2016 lxd vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 15.10 Summary: Several security issues were fixed in LXD. Software Description: - lxd: Container hypervisor based on LXC Details: Robie Basak discovered that LXD incorrectly set permissions when setting up a loop based ZFS pool. A local attacker could use this issue to copy and read the data of any LXD container. (CVE-2016-1581) Robie Basak discovered that LXD incorrectly set permissions when switching an unprivileged container into privileged mode. A local attacker could use this issue to access any world readable path in the container directory, including setuid binaries. (CVE-2016-1582) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: lxd 2.0.2-0ubuntu1~16.04.1 Ubuntu 15.10: lxd 0.20-0ubuntu4.2 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-2988-1 CVE-2016-1581, CVE-2016-1582 Package Information: https://launchpad.net/ubuntu/+source/lxd/2.0.2-0ubuntu1~16.04.1 https://launchpad.net/ubuntu/+source/lxd/0.20-0ubuntu4.2 . Multiple vulnerabilities addressed in LXD. Review Ubuntu patches to safeguard your systems immediately.. Access Control, LXD Security Update, Ubuntu Allocations. . LinuxSecurity.com Team
LXD could be made to run programs as an administrator.. =========================================================================Ubuntu Security Notice USN-2809-1 November 12, 2015 lxd vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.10 Summary: LXD could be made to run programs as an administrator. Software Description: - lxd: Container hypervisor based on LXC Details: Jeroen Simonetti discovered that LXD incorrectly set socket permissions. A local attacker could use this issue to escalate privileges. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.10: lxd 0.20-0ubuntu4.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-2809-1 https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/1515689 Package Information: https://launchpad.net/ubuntu/+source/lxd/0.20-0ubuntu4.1 . LXD security flaw in Ubuntu 15.10 permits local adversaries to gain elevated privileges through improperly set socket permissions.. LXD Privilege Escalation, Ubuntu Upgrade, Security Notice. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.