https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 19:24:28 +0000 https://vulnerability.circl.lu/vuln/ubuntu-cve-2022-47952 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: lxc, Ubuntu:Pro:20.04:LTS: lxc, Ubuntu:Pro:22.04:LTS: lxc, Ubuntu:Pro:24.04:LTS: lxc</p> <p>lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because &#34;Failed to open&#34; often indicates that a file does not exist, whereas &#34;does not refer to a network namespace path&#34; often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that &#34;we will report back to the user that the open() failed but the user has no way of knowing why it failed&#34;; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: lxc, Ubuntu:Pro:20.04:LTS: lxc, Ubuntu:Pro:22.04:LTS: lxc, Ubuntu:Pro:24.04:LTS: lxc</p> <p>lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because &#34;Failed to open&#34; often indicates that a file does not exist, whereas &#34;does not refer to a network namespace path&#34; often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that &#34;we will report back to the user that the open() failed but the user has no way of knowing why it failed&#34;; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2022-47952