Bug 938522 (CVE-2015-1331) - VUL-0: CVE-2015-1331: lxc: directory traversal flaw allowing arbitrary file creation as the root user
Summary: VUL-0: CVE-2015-1331: lxc: directory traversal flaw allowing arbitrary file c...
Status: RESOLVED FIXED
Alias: CVE-2015-1331
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other openSUSE 13.2
: P5 - None : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-07-17 07:51 UTC by Andreas Stieger
Modified: 2017-11-15 15:01 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Andreas Stieger 2015-07-17 08:45:20 UTC 
Checked the code, 1.0 is the first version containing vulnerable code. This means that SLE is not affected.

openSUSE:13.2 with 1.0.6 and Tumbleweed the only affected products.

As this issue is under embargo, do not use patches in OBS before this bug is updated to indicate that the embargo is lifted.

The security team will assign the bug to the community maintainer at that point.
Comment 3 Andreas Stieger 2015-07-22 14:40:31 UTC 
public at http://seclists.org/oss-sec/2015/q3/165

* Roman Fiedler discovered a directory traversal flaw that allows
  arbitrary file creation as the root user. A local attacker must set up
  a symlink at /run/lock/lxc/var/lib/lxc/<CONTAINER>, prior to an admin
  ever creating an LXC container on the system. If an admin then creates
  a container with a name matching <CONTAINER>, the symlink will be
  followed and LXC will create an empty file at the symlink's target as
  the root user. 
  - CVE-2015-1331
  - Affects LXC 1.0.0 and higher
  - https://launchpad.net/bugs/1470842
  - https://github.com/lxc/lxc/commit/72cf81f6a3404e35028567db2c99a90406e9c6e6 (master)
  - https://github.com/lxc/lxc/commit/61ecf69d7834921cc078e14d1b36c459ad8f91c7 (stable-1.1)
  - https://github.com/lxc/lxc/commit/f547349ea7ef3a6eae6965a95cb5986cd921bd99 (stable-1.0)


affects LXC 1.0.0 and higher, please submit for openSUSE 13.2
Comment 4 Jiri Slaby 2015-07-23 09:27:05 UTC 
Fix submitted to 13.2 and factory.
Comment 5 Swamp Workflow Management 2015-07-30 10:07:45 UTC 
openSUSE-SU-2015:1315-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 938522,938523
CVE References: CVE-2015-1331,CVE-2015-1334
Sources used:
openSUSE 13.2 (src):    lxc-1.0.6-3.1
Comment 6 Marcus Meissner 2015-08-10 07:41:39 UTC 
released
Comment 7 Bernhard Wiedemann 2017-11-15 15:01:47 UTC 
This is an autogenerated message for OBS integration:
This bug (938522) was mentioned in
https://build.opensuse.org/request/show/542066 15.0 / lxc