CVE-2016-1582: Infoleak
Published Jun 9, 2016
·Updated
LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary world readable paths in the container directory via unspecified vectors.
Affected Software
3 affected components
Canonical Ubuntu Linux=15.10
Canonical Ubuntu Linux=16.04
Canonical LXD=2.0.1
Event History
Jun 9, 2016
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-1582?
CVE-2016-1582 is classified as medium severity due to improper permission settings for privileged mode containers.
2
How do I fix CVE-2016-1582?
To fix CVE-2016-1582, update LXD to version 2.0.2 or later.
3
What software versions are affected by CVE-2016-1582?
CVE-2016-1582 affects LXD versions prior to 2.0.2 and specific Ubuntu releases including 15.10 and 16.04.
4
Can local users exploit CVE-2016-1582?
Yes, local users can exploit CVE-2016-1582 to access arbitrary world-readable paths within the container.
5
Is CVE-2016-1582 applicable to all Linux distributions?
No, CVE-2016-1582 specifically impacts Ubuntu Linux installations using affected versions of LXD.