This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-6764 →

DEBIAN-CVE-2018-6764

util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended co...

Original description

The description as published by the source.

util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libvirt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-2"}]}]

Debian:13 libvirt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-2"}]}]

Debian:14 libvirt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-2"}]}]

References

advisory security-tracker.debian.org