PT-2016-7539 · Linux Containers+3 · Lxc+3

Andrej Nemec · Published 2015-03-12 · Updated 2024-06-15 · CVE-2016-8649

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LXC versions prior to 1.0.9 LXC versions 2.x prior to 2.0.6

Description The issue allows an attacker inside an unprivileged container to access the host's filesystem via the openat() family of syscalls by using an inherited file descriptor of the host's /proc.

Recommendations For versions prior to 1.0.9, update to version 1.0.9 or later. For versions 2.x prior to 2.0.6, update to version 2.0.6 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2015-1277

ALT-PU-2016-2363

CVE-2016-8649

MGASA-2017-0167

OPENSUSE-SU-2016_3179-1

OPENSUSE-SU-2024:10416-1

USN-3136-1

Affected Products

Alt Linux

Lxc

Suse

Ubuntu

References · 26

• https://github.com/lxc/lxc/commit/81f466d05f2a89cb4f122ef7f593ff3f279b165c · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0167 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-8649 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-8649 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10416-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-8649 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3136-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8649 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3136-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0167.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-8649 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-8649 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1398242 · Patch
• https://ubuntu.com/usn/usn-3224-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8649 · Vendor Advisory