CVE-2017-5985

lxc-user-nic in Linux Containers (LXC) allows local users with a lxc-usernet allocation to create network interfaces on the host and choose the name of those interfaces by leveraging lack of netns ownership check.

CVSS v3 3.3 LOW
CVSS v2.0 2.1 LOW

3.3^/10

CVSS v3 : LOW

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html
http://www.openwall.com/lists/oss-security/2017/03/09/4	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/96777	Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-3224-1	Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1654676	Third Party Advisory
https://github.com/lxc/lxc/commit/16af238036a5464ae8f2420ed3af214f0de875f9	Issue Tracking Patch
https://lists.linuxcontainers.org/pipermail/lxc-devel/2017-March/015535.html	Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html
http://www.openwall.com/lists/oss-security/2017/03/09/4	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/96777	Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-3224-1	Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1654676	Third Party Advisory
https://github.com/lxc/lxc/commit/16af238036a5464ae8f2420ed3af214f0de875f9	Issue Tracking Patch
https://lists.linuxcontainers.org/pipermail/lxc-devel/2017-March/015535.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:linuxcontainers:lxc::::::::
	cpe:2.3:a:linuxcontainers:lxc::::::::

History

No history.

Information

Published : 2017-03-14 17:59

Updated : 2025-04-20 01:37

NVD link : CVE-2017-5985

Mitre link : CVE-2017-5985

CVE.ORG link : CVE-2017-5985

JSON object : View

Products Affected

linuxcontainers

lxc

CWE

CWE-862

Missing Authorization

{"id": "CVE-2017-5985", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "published": "2017-03-14T17:59:00.183", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2017/03/09/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/96777", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.ubuntu.com/usn/USN-3224-1", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1654676", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/lxc/lxc/commit/16af238036a5464ae8f2420ed3af214f0de875f9", "tags": ["Issue Tracking", "Patch"], "source": "cve@mitre.org"}, {"url": "https://lists.linuxcontainers.org/pipermail/lxc-devel/2017-March/015535.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2017/03/09/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/96777", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.ubuntu.com/usn/USN-3224-1", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1654676", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/lxc/lxc/commit/16af238036a5464ae8f2420ed3af214f0de875f9", "tags": ["Issue Tracking", "Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.linuxcontainers.org/pipermail/lxc-devel/2017-March/015535.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "lxc-user-nic in Linux Containers (LXC) allows local users with a lxc-usernet allocation to create network interfaces on the host and choose the name of those interfaces by leveraging lack of netns ownership check."}, {"lang": "es", "value": "lxc-user-nic en Linux Containers (LXC) permite a usuarios locales con una asignaci\u00f3n lxc-usernet crear interfaces de red en el host y elegir el nombre de esas interfaces aprovechando la falta de verificaci\u00f3n de propiedad de netns."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxcontainers:lxc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD42973B-545C-4D49-8DDA-CB3A9D6C68F5", "versionEndIncluding": "1.0.9"}, {"criteria": "cpe:2.3:a:linuxcontainers:lxc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A326DD9B-29E6-4253-8270-B9D85FF0E8AF", "versionEndIncluding": "2.0.6", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}