What’s Vulnerable › Vulnerabilities

CVE-2015-1340: chmod race in doUidshiftIntoContainer

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-04-22 · updated 2026-06-17
• Weakness: CWE-362

Description

LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.

Affected products

• Ubuntu LXD: all versions

References

• https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4
• https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4

Get alerted when CVE-2015-1340 or the next vulnerability affects your stack