CVE-2016-1581
Publication date 31 May 2016
Last updated 25 August 2025
Ubuntu priority
Description
LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop based ZFS pool, which allows local users to copy and read data from arbitrary containers via unspecified vectors.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| lxd | 16.04 LTS xenial |
Fixed 2.0.2-0ubuntu1~16.04.1
|
| 14.04 LTS trusty | Not in release | |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
5.5 · Medium
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
Related Ubuntu Security Notices (USN)
- USN-2988-1
- LXD vulnerabilities
- 31 May 2016