CVE-2015-1335

What it actually does

lxc-start permits a local container administrator to bypass AppArmor confinement by replacing a mount target or bind-mount source with a symlink that resolves outside the container's intended namespace, granting unauthorized access to host filesystem paths and full host privileges.

Why it matters to the business

Successful exploitation allows an attacker who already controls a container to reach the underlying host, potentially compromising all other containers, host data, and any services running on the shared infrastructure; the age of the flaw and lack of fixed versions in many distributions increase long-term exposure risk for legacy deployments.

How an attack unfolds

An attacker with administrative rights inside an LXC container creates a carefully crafted symlink pointing to a sensitive host location, then invokes or waits for lxc-start to process a mount or bind-mount operation; AppArmor fails to validate the resolved path, allowing the mount to succeed and giving the attacker a foothold on the host.

How to fix it

Upgrade LXC to version 1.0.8 or 1.1.4 (or later) on all affected systems; where packages are unavailable, apply distribution-specific backports or replace LXC with a maintained runtime that enforces stricter mount validation.

How to confirm the fix worked

Verify installed LXC version is at least 1.0.8 or 1.1.4; review AppArmor profiles for lxc-start to confirm mount source and target validation rules are present; test that symlink attacks no longer permit host-path access from within a container.

Typical attack path

1. Obtain administrative privileges inside a running LXC container
2. Create a symlink at the expected mount target or bind-mount source that resolves to a host path outside the container
3. Trigger lxc-start (or wait for an automated start) so the mount operation follows the symlink
4. AppArmor confinement is bypassed and attacker gains direct access to host filesystem and processes

How to detect it

Examine system and AppArmor audit logs for lxc-start processes performing unexpected mounts; look for creation of symlinks inside container root filesystems immediately before container start events; correlate with any subsequent host-path access from container processes.

• lxc-start.*mount
• apparmor="DENIED" operation="mount"
• symlink.*lxc

What your security team should do

• Immediately inventory all systems running LXC and schedule upgrades to fixed versions
• Restrict container administrative access to trusted personnel only
• Enable and monitor AppArmor audit logs for unexpected mount or symlink events
• Consider migrating legacy LXC workloads to current container runtimes with stronger isolation defaults