[USN-6738-1] LXD vulnerability

-----BEGIN PGP SIGNATURE-----

wsD5BAABCAAjFiEELRdhz3KY7FGicMD8Vjg+NdFTuLIFAmYmUbIFAwAAAAAACgkQVjg+NdFTuLJa
VAv/c5WsVHJC6jEtYhbz/7/5+Aklecqx6/pZvHbmFdh1gLfNGgRjy+JQpmXK5XxeWWTr43IpytvA
O9QYVDudCLIqjwJ8XNum0fs7YsAKwaV8sMDyQq+VOge9ogJlvwaM5VdWo2qquV0Myve/ZwC9sJ/W
PdOuWARA6bXIv4f/Of5cxnXiirNdBuuOU12sp4khZnxJLAJJq3Kg41cT1QyOeLzjmwjaJFRdiona
pdKqW8Q6q2x+KEyJAWLOZ3Yq2OgIvlLVRiAF1bTRNWHRwZDO8somxsULx2JqCI3bc2lYPv5NkwNh
Z5KzqszK0yqR5GURtByLEck1qq42Yb1OxWRIg8AFTqqvQoi0t0VSGuIg0SwFr66MijfhsDtgYt+t
hQrHVMoqt4xku6PdbjP7ogbNX2qEZGKmR3CxqbEJanYqNaTuBDI+OyiN1FTRVCVeCYoFwQFFpVkn
oFeYUazQFGbNjdeu4SxvaEIqsmqAS25iW/B15HJr/nqcWQx8UuIr7c/p5TGR
=SwrD
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6738-1
April 22, 2024

lxd vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)

Summary:

LXD could be made to bypass integrity checks if it received specially crafted
input.

Software Description:
- lxd: Container hypervisor based on LXC

Details:

Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that LXD
incorrectly handled the handshake phase and the use of sequence numbers in SSH
Binary Packet Protocol (BPP). If a user or an automated system were tricked
into opening a specially crafted input file, a remote attacker could possibly
use this issue to bypass integrity checks.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
lxd 3.0.3-0ubuntu1~18.04.2+esm1
lxd-client 3.0.3-0ubuntu1~18.04.2+esm1
lxd-tools 3.0.3-0ubuntu1~18.04.2+esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
golang-github-lxc-lxd-dev 2.0.11-0ubuntu1~16.04.4+esm1
lxc2 2.0.11-0ubuntu1~16.04.4+esm1
lxd 2.0.11-0ubuntu1~16.04.4+esm1
lxd-client 2.0.11-0ubuntu1~16.04.4+esm1
lxd-tools 2.0.11-0ubuntu1~16.04.4+esm1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6738-1
CVE-2023-48795