CVE catalog

CVE-2022-47952

LXC vulnerabilities

lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that "we will report back to the user that the open() failed but the user has no way of knowing why it failed"; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist.

Severity: Medium · CVSS 6.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Published: Jan 1, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.72% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	lxc	`1:5.0.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-47952]
Debiantrixie	lxc	`1:6.0.4-4+deb13u4`	Fixed	[CVE-2022-47952]
Debiansid	lxc	`1:5.0.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-47952]
Debiansid	lxc	`1:7.0.0-2`	Fixed	[CVE-2022-47952]
Debianforky	lxc	`1:5.0.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-47952]
Debianforky	lxc	`1:7.0.0-2`	Fixed	[CVE-2022-47952]
Debianbookworm	lxc	`1:5.0.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-47952]
Debianbookworm	lxc	`1:5.0.2-1+deb12u4`	Fixed	[CVE-2022-47952]

Showing 8 fix observations. All 34 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	lxc	`1:5.0.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-47952]
Debianbookworm	lxc	`1:5.0.2-1+deb12u4`	Fixed	[CVE-2022-47952]
Debianforky	lxc	`1:5.0.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-47952]
Debianforky	lxc	`1:7.0.0-2`	Fixed	[CVE-2022-47952]
Debiansid	lxc	`1:5.0.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-47952]
Debiansid	lxc	`1:7.0.0-2`	Fixed	[CVE-2022-47952]
Debiantrixie	lxc	`1:5.0.2-1`	FixedDistribution-reported fixed boundary	[CVE-2022-47952]
Debiantrixie	lxc	`1:6.0.4-4+deb13u4`	Fixed	[CVE-2022-47952]
Opensuseleap 15.5	lxc	`6.0.2-bp156.2.3.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2024:0342-1]Feb 4, 2026, 3:25:31 AM UTC
Opensuseleap 15.6	lxc	`6.0.2-bp156.2.3.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2024:0342-1]Feb 4, 2026, 3:25:31 AM UTC
Opensusetumbleweed	lxc	`5.0.2-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2024:12935-1]Feb 4, 2026, 2:38:35 AM UTC
Susepackage hub 15 sp5	lxc	`6.0.2-bp156.2.3.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2024:0342-1]Feb 4, 2026, 3:25:31 AM UTC
Susepackage hub 15 sp6	lxc	`6.0.2-bp156.2.3.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2024:0342-1]Feb 4, 2026, 3:25:31 AM UTC
Ubuntunoble	liblxc-common	`1:5.0.3-2ubuntu7.3+esm1`	UnknownSource applicability is not established	Provider not reported
Ubuntunoble	liblxc-dev	`1:5.0.3-2ubuntu7.3+esm1`	UnknownSource applicability is not established	Provider not reported
Ubuntunoble	liblxc1t64	`1:5.0.3-2ubuntu7.3+esm1`	UnknownSource applicability is not established	Provider not reported
Ubuntunoble	libpam-cgfs	`1:5.0.3-2ubuntu7.3+esm1`	UnknownSource applicability is not established	Provider not reported
Ubuntunoble	lxc	`1:5.0.3-2ubuntu7.3+esm1`	UnknownSource applicability is not established	Provider not reported
Ubuntunoble	lxc-dev	`1:5.0.3-2ubuntu7.3+esm1`	UnknownSource applicability is not established	Provider not reported
Ubuntunoble	lxc-tests	`1:5.0.3-2ubuntu7.3+esm1`	UnknownSource applicability is not established	Provider not reported
Ubuntunoble	lxc-utils	`1:5.0.3-2ubuntu7.3+esm1`	UnknownSource applicability is not established	Provider not reported
Ubuntunoble	lxc1	`1:5.0.3-2ubuntu7.3+esm1`	UnknownSource applicability is not established	Provider not reported
Ubuntupro	lxc	`1:5.0.1-0ubuntu7`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-47952]Sep 28, 2026, 11:30:24 AM UTC
Ubuntupro	lxc	`1:5.0.1-0ubuntu8`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-47952]Sep 28, 2026, 11:30:24 AM UTC
Ubuntupro	lxc	`1:5.0.3-2ubuntu5`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-47952]Sep 28, 2026, 11:30:24 AM UTC
Ubuntupro	lxc	`1:5.0.3-2ubuntu7`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-47952]Sep 28, 2026, 11:30:24 AM UTC
Ubuntupro	lxc	`1:5.0.3-2ubuntu7.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-47952]Sep 28, 2026, 11:30:24 AM UTC
Ubuntupro	lxc	`1:5.0.3-2ubuntu7.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-47952]Sep 28, 2026, 11:30:24 AM UTC
Ubuntupro	lxc	`1:5.0.3-2ubuntu7.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-47952]Sep 28, 2026, 11:30:24 AM UTC
Ubuntupro	lxc	`1:5.0.3-2ubuntu7.3+esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-47952]Sep 28, 2026, 11:30:24 AM UTC
Ubuntupro	lxc	`1:6.0.4-4ubuntu1`	UnknownSource applicability is not established	[USN-8826-1]Sep 28, 2026, 11:42:42 AM UTC
Ubuntupro	lxc	`1:6.0.6-1`	UnknownSource applicability is not established	[USN-8826-1]Sep 28, 2026, 11:42:42 AM UTC
Ubuntupro	lxc	`1:6.0.6-1ubuntu1`	UnknownSource applicability is not established	[USN-8826-1]Sep 28, 2026, 11:42:42 AM UTC
Ubuntupro	lxc	`1:6.0.6-1ubuntu1+esm1`	UnknownSource applicability is not established	[USN-8826-1]Sep 28, 2026, 11:42:42 AM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "lxc",
      "status": "fixed",
      "release": "sid",
      "version": "1:7.0.0-2"
    },
    {
      "name": "lxc",
      "status": "fixed",
      "release": "forky",
      "version": "1:7.0.0-2"
    },
    {
      "name": "lxc",
      "status": "fixed",
      "release": "trixie",
      "version": "1:6.0.4-4+deb13u4"
    },
    {
      "name": "lxc",
      "status": "fixed",
      "release": "bookworm",
      "version": "1:5.0.2-1+deb12u4"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "lxc",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1:5.0.2-1"
    },
    {
      "bug": null,
      "name": "lxc",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1:5.0.2-1"
    },
    {
      "bug": null,
      "name": "lxc",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1:5.0.2-1"
    },
    {
      "bug": null,
      "name": "lxc",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1:5.0.2-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "lxc",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "1:5.0.3-2ubuntu7.3+esm1",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "1:5.0.3-2ubuntu7.3+esm1",
      "applicability_unknown": true
    },
    {
      "name": "liblxc-common",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "1:5.0.3-2ubuntu7.3+esm1",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "1:5.0.3-2ubuntu7.3+esm1",
      "applicability_unknown": true
    },
    {
      "name": "liblxc-dev",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "1:5.0.3-2ubuntu7.3+esm1",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "1:5.0.3-2ubuntu7.3+esm1",
      "applicability_unknown": true
    },
    {
      "name": "liblxc1t64",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "1:5.0.3-2ubuntu7.3+esm1",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "1:5.0.3-2ubuntu7.3+esm1",
      "applicability_unknown": true
    },
    {
      "name": "libpam-cgfs",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "1:5.0.3-2ubuntu7.3+esm1",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "1:5.0.3-2ubuntu7.3+esm1",
      "applicability_unknown": true
    },
    {
      "name": "lxc-dev",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "1:5.0.3-2ubuntu7.3+esm1",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "1:5.0.3-2ubuntu7.3+esm1",
      "applicability_unknown": true
    },
    {
      "name": "lxc-tests",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "1:5.0.3-2ubuntu7.3+esm1",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "1:5.0.3-2ubuntu7.3+esm1",
      "applicability_unknown": true
    },
    {
      "name": "lxc-utils",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "1:5.0.3-2ubuntu7.3+esm1",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "1:5.0.3-2ubuntu7.3+esm1",
      "applicability_unknown": true
    },
    {
      "name": "lxc1",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "1:5.0.3-2ubuntu7.3+esm1",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "1:5.0.3-2ubuntu7.3+esm1",
      "applicability_unknown": true
    },
    {
      "name": "lxc",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:6.0.6-1ubuntu1+esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1:6.0.4-4ubuntu1",
        "1:6.0.6-1",
        "1:6.0.6-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-8826-1",
      "fixed_version": "1:6.0.6-1ubuntu1+esm1",
      "provider_source": "pypi",
      "provider_record_id": "USN-8826-1",
      "provider_updated_at": "2026-09-28T11:42:42.453679404Z",
      "applicability_unknown": true
    },
    {
      "name": "lxc",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:5.0.3-2ubuntu7.3+esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1:5.0.1-0ubuntu7",
        "1:5.0.1-0ubuntu8",
        "1:5.0.3-2ubuntu5",
        "1:5.0.3-2ubuntu7",
        "1:5.0.3-2ubuntu7.1",
        "1:5.0.3-2ubuntu7.2",
        "1:5.0.3-2ubuntu7.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-47952",
      "fixed_version": "1:5.0.3-2ubuntu7.3+esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-47952",
      "provider_updated_at": "2026-09-28T11:30:24.550371089Z",
      "applicability_unknown": true
    },
    {
      "name": "lxc",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.2-bp156.2.3.1"
            }
          ]
        }
      ],
      "release": "package hub 15 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:0342-1",
      "fixed_version": "6.0.2-bp156.2.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:0342-1",
      "provider_updated_at": "2026-02-04T03:25:31.013867Z",
      "applicability_unknown": true
    },
    {
      "name": "lxc",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.2-bp156.2.3.1"
            }
          ]
        }
      ],
      "release": "package hub 15 sp6",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:0342-1",
      "fixed_version": "6.0.2-bp156.2.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:0342-1",
      "provider_updated_at": "2026-02-04T03:25:31.013867Z",
      "applicability_unknown": true
    },
    {
      "name": "lxc",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.2-bp156.2.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:0342-1",
      "fixed_version": "6.0.2-bp156.2.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:0342-1",
      "provider_updated_at": "2026-02-04T03:25:31.013867Z",
      "applicability_unknown": true
    },
    {
      "name": "lxc",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.2-bp156.2.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.6",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:0342-1",
      "fixed_version": "6.0.2-bp156.2.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:0342-1",
      "provider_updated_at": "2026-02-04T03:25:31.013867Z",
      "applicability_unknown": true
    },
    {
      "name": "lxc",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.2-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:12935-1",
      "fixed_version": "5.0.2-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:12935-1",
      "provider_updated_at": "2026-02-04T02:38:35.266179Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[liblxc1]Unknown
Source package: [lxc]
Details (2)
- 1:5.0.2-1+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 1:5.0.2-1
  usn · lxc · debian · bookworm
- 1:5.0.2-1+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 1:5.0.2-1
  usn · lxc · debian · bookworm
[liblxc-common]Unknown
Source package: [lxc]
Details (2)
- 1:5.0.2-1+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 1:5.0.2-1
  usn · lxc · debian · bookworm
- 1:5.0.2-1+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 1:5.0.2-1
  usn · lxc · debian · bookworm
[libpam-cgfs]Unknown
Source package: [lxc]
Details (2)
- 1:5.0.2-1+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 1:5.0.2-1
  usn · lxc · debian · bookworm
- 1:5.0.2-1+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 1:5.0.2-1
  usn · lxc · debian · bookworm
[lxc]Unknown
Details (2)
- 1:5.0.2-1+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 1:5.0.2-1
  usn · lxc · debian · bookworm
- 1:5.0.2-1+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 1:5.0.2-1
  usn · lxc · debian · bookworm
[lxc-dev]Unknown
Source package: [lxc]
Details (2)
- 1:5.0.2-1+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 1:5.0.2-1
  usn · lxc · debian · bookworm
- 1:5.0.2-1+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 1:5.0.2-1
  usn · lxc · debian · bookworm
[lxc-tests]Unknown
Source package: [lxc]
Details (2)
- 1:5.0.2-1+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 1:5.0.2-1
  usn · lxc · debian · bookworm
- 1:5.0.2-1+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 1:5.0.2-1
  usn · lxc · debian · bookworm

[openSUSE Tumbleweed]

[liblxc1]Unknown
Source package: [lxc]
Details (1)
- 7.0.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 5.0.2-1.1
  Version impact unknown
  usn · lxc · opensuse · tumbleweed
[liblxc-devel]Unknown
Source package: [lxc]
Details (1)
- 7.0.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 5.0.2-1.1
  Version impact unknown
  usn · lxc · opensuse · tumbleweed
[lxc]Unknown
Source package: [lxc]
Details (1)
- 7.0.0-1.3 · x86_64 · tumbleweed
  Fixed · Fixed: 5.0.2-1.1
  usn · lxc · opensuse · tumbleweed
[lxc-bash-completion]Unknown
Source package: [lxc]
Details (1)
- 7.0.0-1.3 · noarch · tumbleweed
  Unknown · Fixed: 5.0.2-1.1
  Version impact unknown
  usn · lxc · opensuse · tumbleweed
[lxc-ja-doc]Unknown
Source package: [lxc]
Details (1)
- 7.0.0-1.3 · noarch · tumbleweed
  Unknown · Fixed: 5.0.2-1.1
  Version impact unknown
  usn · lxc · opensuse · tumbleweed
[lxc-ko-doc]Unknown
Source package: [lxc]
Details (1)
- 7.0.0-1.3 · noarch · tumbleweed
  Unknown · Fixed: 5.0.2-1.1
  Version impact unknown
  usn · lxc · opensuse · tumbleweed
[pam_cgfs]Unknown
Source package: [lxc]
Details (1)
- 7.0.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 5.0.2-1.1
  Version impact unknown
  usn · lxc · opensuse · tumbleweed

Observed: Oct 23, 2026, 6:31:31 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]