Permissions, Privileges, and Access Controls in LXS - CVE-2016-8649
Published: May 1, 2017 / Updated: July 18, 2020
Vulnerability identifier: #VU31423
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-8649
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute arbitrary code.
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.
Affected software
LXS
Fedora
Opensuse
lxc
Fedora
Opensuse
lxc
How to mitigate CVE-2016-8649
Install update from vendor's website.
LXS - update to 2.0.6
lxc - addressed in versions 1.0.9-1.el6, 1.0.9-1.el7, 2.0.6-2.fc23, 2.0.6-2.fc24, 2.0.6-2.fc25
lxc - addressed in versions 1.0.9-1.el6, 1.0.9-1.el7, 2.0.6-2.fc23, 2.0.6-2.fc24, 2.0.6-2.fc25
External References
- http://www.securityfocus.com/bid/94498
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845465
- https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1639345
- https://bugzilla.redhat.com/show_bug.cgi?id=1398242
- https://github.com/lxc/lxc/commit/81f466d05f2a89cb4f122ef7f593ff3f279b165c
- https://security-tracker.debian.org/tracker/CVE-2016-8649