CVE-2015-6927: Low severity openvz vzctl vulnerability
Published Sep 28, 2015
·Updated
vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel.
Affected Software
1 affected component
OpenVZ Vzctl<=4.9.3
Remediation
Patch Available
Event History
Sep 28, 2015
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-6927?
The severity of CVE-2015-6927 is classified as low with a score of 3.6.
2
What type of vulnerability is CVE-2015-6927?
CVE-2015-6927 is a local privilege escalation vulnerability that affects OpenVZ Vzctl.
3
How do I fix CVE-2015-6927?
You can fix CVE-2015-6927 by applying the available patch for OpenVZ Vzctl.
4
Who is affected by CVE-2015-6927?
Local users of simfs containers with root access are affected by CVE-2015-6927.
5
What software is impacted by CVE-2015-6927?
CVE-2015-6927 impacts the OpenVZ Vzctl prior to version 4.9.4.