CVE-2017-5985

What it actually does

The flaw allows a local user with lxc-usernet allocation to create network interfaces on the host and specify their names due to missing ownership checks on network namespaces.

Why it matters to the business

Attackers with limited access can manipulate host network configuration, potentially disrupting container networking or enabling lateral movement in environments using LXC.

How an attack unfolds

An attacker with a valid lxc-usernet allocation invokes lxc-user-nic and supplies parameters that bypass the absent netns ownership verification, resulting in creation of arbitrary host network interfaces with attacker-chosen names.

How to fix it

Upgrade lxc/lxc to the version containing commit 16af238036a5464ae8f2420ed3af214f0de875f9 or later.

How to confirm the fix worked

Confirm the installed lxc-user-nic binary originates from a build that includes commit 16af238036a5464ae8f2420ed3af214f0de875f9; attempt interface creation from a non-privileged context to verify enforcement.

Typical attack path

1. Obtain or be granted an lxc-usernet allocation
2. Invoke lxc-user-nic with crafted interface name and namespace parameters
3. Trigger creation of unauthorized network interface on the host

How to detect it

Review system logs for invocations of lxc-user-nic by non-root users; inspect network interface creation events for unexpected names or owners; correlate with container namespace activity.

• lxc-user-nic
• netns ownership
• unexpected host interface creation

What your security team should do

• Apply the fixed commit 16af238036a5464ae8f2420ed3af214f0de875f9 across all LXC installations
• Audit existing lxc-usernet allocations and revoke unnecessary grants
• Restrict local users from direct execution of lxc-user-nic where possible