Skip to content
OpenAdvisories
Unscored USN-2988-1 2 CVEs

lxd vulnerabilities

Published May 31, 2016 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Robie Basak discovered that LXD incorrectly set permissions when setting up
a loop based ZFS pool. A local attacker could use this issue to copy and
read the data of any LXD container. (CVE-2016-1581)

Robie Basak discovered that LXD incorrectly set permissions when switching
an unprivileged container into privileged mode. A local attacker could use
this issue to access any world readable path in the container directory,
including setuid binaries. (CVE-2016-1582)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS lxd 2.0.2-0ubuntu1~16.04.1

Vulnerabilities 2

  • Unscored —
    CVE-2016-1581

    LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop based ZFS pool, which …

    lxd Ubuntu
  • Unscored —
    CVE-2016-1582

    LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which…

    lxd Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2016-1581
  • report
    https://ubuntu.com/security/CVE-2016-1582