USN-6738-1: LXD vulnerability
22 April 2024
LXD could be made to bypass integrity checks if it received specially crafted input.
Releases
Packages
- lxd - Container hypervisor based on LXC
Details
Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that LXD
incorrectly handled the handshake phase and the use of sequence numbers in SSH
Binary Packet Protocol (BPP). If a user or an automated system were tricked
into opening a specially crafted input file, a remote attacker could possibly
use this issue to bypass integrity checks.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 18.04
-
lxd
-
3.0.3-0ubuntu1~18.04.2+esm1
Available with Ubuntu Pro
-
lxd-client
-
3.0.3-0ubuntu1~18.04.2+esm1
Available with Ubuntu Pro
-
lxd-tools
-
3.0.3-0ubuntu1~18.04.2+esm1
Available with Ubuntu Pro
Ubuntu 16.04
-
golang-github-lxc-lxd-dev
-
2.0.11-0ubuntu1~16.04.4+esm1
Available with Ubuntu Pro
-
lxc2
-
2.0.11-0ubuntu1~16.04.4+esm1
Available with Ubuntu Pro
-
lxd
-
2.0.11-0ubuntu1~16.04.4+esm1
Available with Ubuntu Pro
-
lxd-client
-
2.0.11-0ubuntu1~16.04.4+esm1
Available with Ubuntu Pro
-
lxd-tools
-
2.0.11-0ubuntu1~16.04.4+esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-6560-1: ssh-askpass-gnome, openssh, openssh-sftp-server, openssh-client, ssh, openssh-tests, openssh-server
- USN-6561-1: libssh-dev, libssh-gcrypt-dev, libssh-doc, libssh, libssh-gcrypt-4, libssh-4
- USN-6560-2: ssh, ssh-askpass-gnome, openssh, openssh-sftp-server, ssh-krb5, openssh-client, openssh-client-ssh1, openssh-server
- USN-6585-1: libssh2, libssh2-1, libssh2-1-dev
- USN-6589-1: filezilla, filezilla-common
- USN-6598-1: python3-paramiko, paramiko-doc, paramiko