PT-2016-7539 · Linux Containers+3 · Lxc+3

Andrej Nemec · Publicado 2015-03-12 · Atualizado 2024-06-15 · CVE-2016-8649

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LXC versions prior to 1.0.9 LXC versions 2.x prior to 2.0.6

Description The issue allows an attacker inside an unprivileged container to access the host's filesystem via the openat() family of syscalls by using an inherited file descriptor of the host's /proc.

Recommendations For versions prior to 1.0.9, update to version 1.0.9 or later. For versions 2.x prior to 2.0.6, update to version 2.0.6 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2015-1277

ALT-PU-2016-2363

CVE-2016-8649

MGASA-2017-0167

OPENSUSE-SU-2016_3179-1

OPENSUSE-SU-2024:10416-1

USN-3136-1

Produtos afetados

Alt Linux

Lxc

Suse

Ubuntu

Referências · 26

• https://github.com/lxc/lxc/commit/81f466d05f2a89cb4f122ef7f593ff3f279b165c · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2017-0167 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-8649 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-8649 · Aviso do Fabricante
• https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1639345 · Nota
• https://suse.com/security/cve/CVE-2016-8649 · Nota
• https://suse.com/security/cve/CVE-2015-1331 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10416-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-8649 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3136-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-8649 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-1335 · Nota
• https://osv.dev/vulnerability/USN-3136-1 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2017-0167.html · Nota de Segurança
• http://securityfocus.com/bid/94498 · Nota