Unscored severity · published Dec 7, 2015
CVE-2015-1344
The do_write_pids function in lxcfs.c in LXCFS before 0.12 does not properly check permissions, which allows local users to gain privileges by writing a pid to the tasks file
–
CVSS
0.4%
EPSS
No
On KEV
Description
The do_write_pids function in lxcfs.c in LXCFS before 0.12 does not properly check permissions, which allows local users to gain privileges by writing a pid to the tasks file.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LX
Lxcfs · Canonical
through 0.11 · source: NVD
UL
Ubuntu Linux · Canonical
15.04; 15.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1344
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1344
www.ubuntu.com
http://www.ubuntu.com/usn/USN-2813-1
bugs.launchpad.net
https://bugs.launchpad.net/ubuntu/+source/lxcfs/+bug/1512854
github.com
https://github.com/lxc/lxcfs/commit/8ee2a503e102b1a43ec4d83113dc275ab20a869a
More from Lxcfs
–
CVE-2015-1342
LXCFS before 0.12 does not properly enforce directory escapes, which might allow local users to gain privileges by (1) querying or (2) updating a cgroup