In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.
Weakness
The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Systemd | Systemd_project | 233 (including) | 257.12 (excluding) |
| Systemd | Systemd_project | 258 (including) | 258.6 (excluding) |
| Systemd | Systemd_project | 259 (including) | 259.4 (excluding) |
| Red Hat Hardened Images | RedHat | systemd-main-260.1-2.1.hum1 | * |
| Systemd | Ubuntu | esm-infra/xenial | * |
| Systemd | Ubuntu | jammy | * |
| Systemd | Ubuntu | noble | * |
| Systemd | Ubuntu | questing | * |
| Systemd | Ubuntu | upstream | * |
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/141.html
- https://cwe.mitre.org/data/definitions/142.html
- https://cwe.mitre.org/data/definitions/73.html
- https://cwe.mitre.org/data/definitions/76.html
- https://cwe.mitre.org/data/definitions/85.html