Cloudanix VulnDB

CVE-2015-1331

None

CVSS

—

EPSS

0.5%

Published

Aug 12, 2015

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Older container software contains a flaw that lets someone already logged into the system create files in restricted locations, which could allow them to gain broader control of the machine.

Exploit Available
Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Data Tampering
Component
Application
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A local attacker can exploit a symlink race condition in lxclock.c to create arbitrary files on the system by targeting lock files in /run/lock/lxc/.

Why it matters to the business

Attackers with local access can create files anywhere on container hosts, potentially leading to privilege escalation, persistence, or full system compromise in environments using older LXC versions.

How an attack unfolds

An attacker with local access on a host running vulnerable LXC creates a symlink from a lock file path under /run/lock/lxc/ to a chosen target file, then triggers container locking operations so that file creation follows the symlink and writes to the unintended location.

How to fix it

Upgrade LXC to a version newer than 1.1.2 that resolves the symlink handling flaw in lxclock.c; apply vendor patches or rebuild from fixed source if no package is available.

How to confirm the fix worked

Confirm LXC version exceeds 1.1.2, review lxclock.c for proper symlink handling, and test by attempting symlink creation under /run/lock/lxc/ during container operations to ensure it fails safely.

Typical attack path

  1. Obtain local shell access on an LXC host
  2. Create a malicious symlink pointing from /run/lock/lxc/ to a target file
  3. Trigger LXC container start or locking routines to follow the symlink
  4. Verify creation of the arbitrary file and leverage for further access

How to detect it

Search host logs and audit trails for unexpected file creation events or symlink operations involving /run/lock/lxc/, inspect LXC container startup processes, and review filesystem changes under lock directories during the vulnerable period.

  • /run/lock/lxc/
  • lxclock
  • symlink.*lock.*lxc

What your security team should do

  • Immediately upgrade all LXC installations beyond version 1.1.2
  • Limit local user access on container hosts to trusted administrators only
  • Implement file integrity monitoring on /run/lock/lxc/ and system directories
  • Review container host logs for historical signs of unexpected file creation

The record

lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 lxc 0 1:1.0.7-4
Debian:12 lxc 0 1:1.0.7-4
Debian:13 lxc 0 1:1.0.7-4
Debian:8 lxc 0 1:1.0.6-6+deb8u1
Mageia:5 lxc 0 1.0.5-3.1.mga5
Ubuntu:14.04:LTS lxc 0 1.0.7-0ubuntu0.2
openSUSE:Tumbleweed lxc 0 2.0.4-2.1

Related vulnerabilities