lxc vulnerabilities

A vulnerability in lxc before version 1.0.8 and 1.1.x before version 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on (1) mount target or (2) bind mount source.

In LXC 7.0.0 and earlier, lxc-copy and the public liblxc clone() API can follow attacker-controlled symbolic links while updating /etc/hostname in a copied container root filesystem. The privileged cloning process must run as root, and the source rootfs must be attacker-controlled or less trusted. A symlink can be placed at etc/hostname or in an intermediate component, and the clone operation preserves the symlink before updating the hostname, causing the privileged process to overwrite an existing host file outside the destination rootfs. Unprivileged use and managers with independent cloning implementations are not affected, and LXC_CLONE_KEEPNAME avoids the affected write.

lxc, a Linux container runtime, has a logic flaw in the find_line() function of the setuid helper lxc-user-nic, allowing an unprivileged user to delete OVS-attached network interfaces belonging to other users. This affects multi-tenant environments using OpenVSwitch bridges. An attacker can repeatedly disconnect networking from containers of other tenants, causing denial of service. The issue is fixed in version 7.0.0.