What is the CVSS score of CVE-2018-6556?

CVE-2018-6556 has a CVSS 3.0 base score of 3.3 (Low). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2018-6556?

Yes, a patch is available for CVE-2018-6556. Update the affected software to the latest version immediately.

Ubuntu Linux CVE-2018-6556

LOW

Communication Channel Errors (CWE-417)

2018-08-10 security@ubuntu.com

Information Disclosure Ubuntu Linux Lxc Caas Platform Openstack Cloud Suse Linux Enterprise Server Leap

3.3

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Aug 10, 2018 - 15:29 nvd

LOW 3.3

DescriptionNVD

lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). Affected releases are LXC: 2.0 versions above and including 2.0.9; 3.0 versions above and including 3.0.0, prior to 3.0.2.

AnalysisAI

lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-417. lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). Affected releases are LXC: 2.0 versions above and including 2.0.9; 3.0 versions above and including 3.0.0, prior to 3.0.2. Affected products include: Canonical Ubuntu Linux, Linuxcontainers Lxc, Suse Caas Platform, Suse Openstack Cloud, Suse Suse Linux Enterprise Server. Version information: prior to 3.0.2..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.