Unscored severity · published Dec 7, 2015
CVE-2015-1342
LXCFS before 0.12 does not properly enforce directory escapes, which might allow local users to gain privileges by (1) querying or (2) updating a cgroup
–
CVSS
0.5%
EPSS
No
On KEV
Description
LXCFS before 0.12 does not properly enforce directory escapes, which might allow local users to gain privileges by (1) querying or (2) updating a cgroup.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LX
Lxcfs · Canonical
through 0.11 · source: NVD
UL
Ubuntu Linux · Canonical
15.04; 15.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1342
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1342
www.ubuntu.com
http://www.ubuntu.com/usn/USN-2813-1
Exploit
https://bugs.launchpad.net/ubuntu/+source/lxcfs/+bug/1508481
github.com
https://github.com/lxc/lxcfs/commit/a8b6c3e0537e90fba3c55910fd1b7229d54a60a7
More from Lxcfs
–
CVE-2015-1344
The do_write_pids function in lxcfs.c in LXCFS before 0.12 does not properly check permissions, which allows local users to gain privileges by writing a pid to the tasks file