Ubuntu Security Notice USN-2451-1
5th January, 2015
cgmanager vulnerability
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 14.10
- Ubuntu 14.04 LTS
Summary
cgmanager could be made to expose sensitive information or devices to
containers running on the system.
Software description
- cgmanager
– Central cgroup manager daemon
Details
Serge Hallyn discovered that cgmanager did not consistently enforce
proper nesting when modifying cgroup properties. A local attacker in a
privileged container could use this to set cgroup values for all cgroups.
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 14.10:
-
cgmanager
0.32-4ubuntu1.1
- Ubuntu 14.04 LTS:
-
cgmanager
0.24-0ubuntu7.1
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make
all the necessary changes.