title: Malicious image running containers may cause DoS attacks
description: iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.
problem types: CWE-665 Improper Initialization
affected:
{
collectionURL: https://gitee.com/src-openeuler
defaultStatus: unaffected
modules: runtime
packageName: lcr
platforms: Linux
product: lcr
programFiles: https://gitee.com/openeuler/lcr/blob/master/src/runtime/lcrcontainer.c
repo: https://gitee.com/src-openeuler/lcr
vendor: openEuler
versions:
changes: [at: 0012-265-set-env-to-avoid-invoke-lxc-binary-directly.patch, status: unaffected], lessThanOrEqual: 2.0.9-6,2.1.2-3, status: affected, version: 0, versionType: patch
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL