[USN-6738-1] LXD vulnerability

[Amir Naseredini]

==========================================================================
Ubuntu Security Notice USN-6738-1
April 22, 2024

lxd vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)

Summary:

LXD could be made to bypass integrity checks if it received specially crafted
input.

Software Description:
- lxd: Container hypervisor based on LXC

Details:

Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that LXD
incorrectly handled the handshake phase and the use of sequence numbers in SSH
Binary Packet Protocol (BPP). If a user or an automated system were tricked
into opening a specially crafted input file, a remote attacker could possibly
use this issue to bypass integrity checks.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
   lxd                             3.0.3-0ubuntu1~18.04.2+esm1
   lxd-client                      3.0.3-0ubuntu1~18.04.2+esm1
   lxd-tools                       3.0.3-0ubuntu1~18.04.2+esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
   golang-github-lxc-lxd-dev       2.0.11-0ubuntu1~16.04.4+esm1
   lxc2                            2.0.11-0ubuntu1~16.04.4+esm1
   lxd                             2.0.11-0ubuntu1~16.04.4+esm1
   lxd-client                      2.0.11-0ubuntu1~16.04.4+esm1
   lxd-tools                       2.0.11-0ubuntu1~16.04.4+esm1

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6738-1
   CVE-2023-48795
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 665 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20240422/3cbd5643/attachment.sig>