CVE-2018-6556

Name	CVE-2018-6556
Description	lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). Affected releases are LXC: 2.0 versions above and including 2.0.9; 3.0 versions above and including 3.0.0, prior to 3.0.2.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	905586

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
lxc (PTS)	bullseye	1:4.0.6-2+deb11u2	fixed
	bookworm	1:5.0.2-1+deb12u2	fixed
	sid, trixie	1:6.0.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
lxc	source	jessie	(not affected)
lxc	source	stretch	(not affected)
lxc	source	(unstable)	1:2.0.9-6.1	905586

Notes

[stretch] - lxc <not-affected> (Vulnerable code introduced later)
[jessie] - lxc <not-affected> (Vulnerable code introduced later)
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1783591
Prerequisite: https://github.com/lxc/lxc/commit/f96f5f3c1341e73ee51c8b49bef4ba571c562d8c
Fixed by: https://github.com/lxc/lxc/commit/5eb45428b312e978fb9e294dde16efb14dd9fa4d