PT-2017-7750 · Linux+2 · Linux Containers+2

Published 2016-08-22 · Updated 2017-11-13 · CVE-2016-10124

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Linux Containers (LXC) versions prior to 2016-02-22

Description An issue in Linux Containers allows a non-privileged session to escape to the parent session. This is achieved by using the TIOCSTI ioctl to push characters into the terminal's input buffer, enabling an attacker to escape the container.

Recommendations For versions prior to 2016-02-22, update to a version released after 2016-02-22 to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2016-1870

CVE-2016-10124

USN-3375-1

Affected Products

Alt Linux

Linux Containers

Ubuntu

References · 14

• https://github.com/lxc/lxc/commit/e986ea3dfa4a2957f71ae9bfaed406dd6e1ffff6 · Patch
• https://security-tracker.debian.org/tracker/CVE-2016-10124 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10124 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-10124 · Security Note
• https://osv.dev/vulnerability/USN-3375-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10124 · Vendor Advisory
• https://security.gentoo.org/glsa/201711-09 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-10124 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3375-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10124 · Vendor Advisory
• http://openwall.com/lists/oss-security/2015/09/03/5 · Note
• http://securityfocus.com/bid/95404 · Note
• http://openwall.com/lists/oss-security/2014/12/15/5 · Note