USN-8826-1: LXC vulnerabilities
Ubuntu's USN-8826-1 fixes LXC flaws that may leak sensitive logs and allow denial of service.
Ubuntu published USN-8826-1 covering two LXC vulnerabilities. CVE-2022-47952, discovered by Maher Azzouzi, is incorrect handling of certain failure-message logs that could leak sensitive information, and it affects Ubuntu 16.04 LTS through 24.04 LTS. CVE-2026-39402, discovered by Sam Sanoop, is incorrect handling of some user-authorization forms that could let an attacker cause a denial of service. The notice does not report active exploitation.
- CVE-2022-47952 may leak sensitive data through LXC failure-message logs.
- That logging flaw affects Ubuntu 16.04 LTS through 24.04 LTS.
- CVE-2026-39402 can cause denial of service via flawed user authorization.
- The notice does not report exploitation in the wild.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-47952 | lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree… | 3.3 | <1% | ||
| CVE-2026-39402 | lxc is a Linux container runtime | 4.3 | <1% | PoC |
From the original article
Maher Azzouzi discovered that LXC did not correctly handle logging certain failure messages. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 16.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.