CVE-2016-8649
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker ...
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Ubuntu (medium).
Description
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | lxc | 1:2.0.6-1 |
| debian 12 | lxc | 1:2.0.6-1 |
| debian 13 | lxc | 1:2.0.6-1 |
| debian 14 | lxc | 1:2.0.6-1 |
| debian 7 | lxc | no fix listed |
| debian 8 | lxc | 1:1.0.6-6+deb8u5 |
| echo | lxc | 1:2.0.6-1 |
| ubuntu 14.04 | lxc | 1.0.8-0ubuntu0.4 |
| ubuntu 14.04-ESM | lxc | 1.0.8-0ubuntu0.4 |
| ubuntu 16.04 | lxc | 2.0.5-0ubuntu1~ubuntu16.04.3 |
| ubuntu 16.04-ESM | lxc | 2.0.5-0ubuntu1~ubuntu16.04.3 |
| ubuntu 16.10 | lxc | 2.0.5-0ubuntu1.2 |
Show all 13 entries from 13 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | lxc | 1:2.0.6-1 |
| debian 12 | lxc | 1:2.0.6-1 |
| debian 13 | lxc | 1:2.0.6-1 |
| debian 14 | lxc | 1:2.0.6-1 |
| debian 7 | lxc | no fix listed |
| debian 8 | lxc | 1:1.0.6-6+deb8u5 |
| echo | lxc | 1:2.0.6-1 |
| ubuntu 14.04 | lxc | 1.0.8-0ubuntu0.4 |
| ubuntu 14.04-ESM | lxc | 1.0.8-0ubuntu0.4 |
| ubuntu 16.04 | lxc | 2.0.5-0ubuntu1~ubuntu16.04.3 |
| ubuntu 16.04-ESM | lxc | 2.0.5-0ubuntu1~ubuntu16.04.3 |
| ubuntu 16.10 | lxc | 2.0.5-0ubuntu1.2 |
| ubuntu 17.04 | lxc | 2.0.5-0ubuntu4 |
References
- http://www.securityfocus.com/bid/94498
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845465
- https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1639345
- https://bugzilla.redhat.com/show_bug.cgi?id=1398242
- https://github.com/lxc/lxc/commit/81f466d05f2a89cb4f122ef7f593ff3f279b165c
- https://security-tracker.debian.org/tracker/CVE-2016-8649
- https://ubuntu.com/security/notices/USN-3136-1
- https://www.cve.org/CVERecord?id=CVE-2016-8649