CVE-2016-8649
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker ...
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Ubuntu (media).
Descripción
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | lxc | 1:2.0.6-1 |
| debian 12 | lxc | 1:2.0.6-1 |
| debian 13 | lxc | 1:2.0.6-1 |
| debian 14 | lxc | 1:2.0.6-1 |
| debian 7 | lxc | sin corrección indicada |
| debian 8 | lxc | 1:1.0.6-6+deb8u5 |
| echo | lxc | 1:2.0.6-1 |
| ubuntu 14.04 | lxc | 1.0.8-0ubuntu0.4 |
| ubuntu 14.04-ESM | lxc | 1.0.8-0ubuntu0.4 |
| ubuntu 16.04 | lxc | 2.0.5-0ubuntu1~ubuntu16.04.3 |
| ubuntu 16.04-ESM | lxc | 2.0.5-0ubuntu1~ubuntu16.04.3 |
| ubuntu 16.10 | lxc | 2.0.5-0ubuntu1.2 |
Mostrar las 13 entradas de 13 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | lxc | 1:2.0.6-1 |
| debian 12 | lxc | 1:2.0.6-1 |
| debian 13 | lxc | 1:2.0.6-1 |
| debian 14 | lxc | 1:2.0.6-1 |
| debian 7 | lxc | sin corrección indicada |
| debian 8 | lxc | 1:1.0.6-6+deb8u5 |
| echo | lxc | 1:2.0.6-1 |
| ubuntu 14.04 | lxc | 1.0.8-0ubuntu0.4 |
| ubuntu 14.04-ESM | lxc | 1.0.8-0ubuntu0.4 |
| ubuntu 16.04 | lxc | 2.0.5-0ubuntu1~ubuntu16.04.3 |
| ubuntu 16.04-ESM | lxc | 2.0.5-0ubuntu1~ubuntu16.04.3 |
| ubuntu 16.10 | lxc | 2.0.5-0ubuntu1.2 |
| ubuntu 17.04 | lxc | 2.0.5-0ubuntu4 |
Referencias
- http://www.securityfocus.com/bid/94498
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845465
- https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1639345
- https://bugzilla.redhat.com/show_bug.cgi?id=1398242
- https://github.com/lxc/lxc/commit/81f466d05f2a89cb4f122ef7f593ff3f279b165c
- https://security-tracker.debian.org/tracker/CVE-2016-8649
- https://ubuntu.com/security/notices/USN-3136-1
- https://www.cve.org/CVERecord?id=CVE-2016-8649