data/reports/GO-2021-0071.yaml

modules:
  - module: github.com/lxc/lxd
    versions:
      - fixed: 0.0.0-20151004155856-19c6961cc101
    vulnerable_at: 0.0.0-20151004071337-96e120e828e4
    packages:
      - package: github.com/lxc/lxd/shared
        symbols:
          - IdmapSet.doUidshiftIntoContainer
        skip_fix: 'TODO: Revisit this reason (Fix causes error containing cannot find
            module providing package github.com/chai2010/gettext-go/gettext - possibly
            an issue with lack of go.mod file in affected version)'
description: |
    A race between chown and chmod operations during a container
    filesystem shift may allow a user who can modify the filesystem to
    chmod an arbitrary path of their choice, rather than the expected
    path.
published: 2021-04-14T20:04:52Z
cves:
  - CVE-2015-1340
ghsas:
  - GHSA-8mpq-fmr3-6jxv
credit: Seth Arnold
references:
  - fix: https://github.com/lxc/lxd/pull/1189
  - fix: https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4
  - web: https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/1502270