{"id":"CVE-2015-1340","aliases":["EUVD-2022-3203","GHSA-8mpq-fmr3-6jxv","GO-2021-0071"],"status":"published","title":"chmod race in doUidshiftIntoContainer","description":"LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.","severity":{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00896,"percentile":0.59817,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2019-04-22T15:35:59Z","modified":"2026-06-17T00:22:13Z","fixes":[{"ecosystem":"Go","package":"github.com/lxc/lxd","fixed_in":["0.0.0-20151004155856-19c6961cc101"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/lxc/lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20151004155856-19c6961cc101"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/lxc/lxd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20151004155856-19c6961cc101"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/lxc/lxd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20151004155856-19c6961cc101"}]}]}],"products":[{"vendor":"canonical","product":"lxd"},{"vendor":"linuxcontainers","product":"lxd"},{"vendor":"ubuntu","product":"lxd"}],"references":[{"url":"https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1340","tags":["advisory"]},{"url":"https://github.com/lxc/lxd/pull/1189","tags":["web"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/1502270","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2021-0071","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8mpq-fmr3-6jxv"},{"url":"https://github.com/lxc/lxd","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2015-1340","title":"chmod race in doUidshiftIntoContainer","description":"LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.","status":"published","published":"2019-04-22T15:35:59.288Z","modified":"2024-09-17T01:10:47.579Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2022-3203","description":"LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.","status":"published","published":"2019-04-22T15:35:59Z","modified":"2024-09-17T01:10:47Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:52.18343Z"}],"ghsa":[{"id":"GHSA-8mpq-fmr3-6jxv","title":"LXD vulnerable to Race Condition","description":"LXD before version 0.19-0ubuntu5 `doUidshiftIntoContainer()` has an unsafe `Chmod()` call that races against the stat in the `Filepath.Walk()` function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.\n\n### Specific Go Packages Affected\ngithub.com/lxc/lxd/shared","status":"published","published":"2022-05-24T16:44:07Z","modified":"2023-09-29T15:43:25Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:37:06.913882Z"}],"nvd":[{"id":"CVE-2015-1340","description":"LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.","status":"published","published":"2019-04-22T16:29:00.897Z","modified":"2026-06-17T00:22:13.613Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:03:19.73542Z"}],"osv":[{"id":"GHSA-8mpq-fmr3-6jxv","title":"LXD vulnerable to Race Condition","description":"LXD before version 0.19-0ubuntu5 `doUidshiftIntoContainer()` has an unsafe `Chmod()` call that races against the stat in the `Filepath.Walk()` function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.\n\n### Specific Go Packages Affected\ngithub.com/lxc/lxd/shared","status":"published","published":"2022-05-24T16:44:07Z","modified":"2023-11-08T03:57:49.708284Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"GO-2021-0071","title":"Race condition in github.com/lxc/lxd","description":"A race between chown and chmod operations during a container filesystem shift may allow a user who can modify the filesystem to chmod an arbitrary path of their choice, rather than the expected path.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2024-06-03T20:51:31Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}