TI-2022-23763 Aliases CVE-2022-47952 GHSA-qv29-rjwj-jjrm

lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to…

LOW 17CWE-203Published 2023-01-01 · Updated 2025-04-10

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-203.

Summary

lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that "we will report back to the user that the open() failed but the user has no way of knowing why it failed"; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00722 54th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxcontainers:lxc::::::::	up to 5.0.1	Vulnerable	lxc

cpe:2.3:a:linuxcontainers:lxc:*:*:*:*:*:*:*:* Versions up to 5.0.1 Vulnerable ·lxc

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2022-47952
2026-10-03 Alias added: GHSA-qv29-rjwj-jjrm

References

Advisory 4

Other 1

[debian-lts-announce] 20230821 [SECURITY] [DLA 3533-1] lxc security update

TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
TI-2026-28386 lxc lxc-user-nic insufficient ownership validation allows cross-tenant OVS port deletion CVSS 4.0MEDIUM 4.3
TI-2016-07111 Access control flaw in LXC before 1.0.9 and 2.x before 2.0.6 CVSS 3.0CRITICAL 9.1
TI-2016-08200 An issue was discovered in Linux Containers (LXC) before 2016-02-22. CVSS 3.0HIGH 8.6
TI-2017-13795 In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a… CVSS 3.1HIGH 8.1
TI-2015-01214 lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container… CVSS 2.0HIGH 7.2

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences