CVE-2016-8649 Path traversal in LXC before 1.0.9 and 2.x before 2.0.6
An attacker inside an unprivileged LXC container can access the host filesystem via inherited file descriptors, leading to data exposure and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-8649?
CVE-2016-8649 is a critical path traversal vulnerability in LXC before 1.0.9 and 2.x before 2.0.6, published on 1 May 2017. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.
Weakness: CWE-264
Which versions are affected by CVE-2016-8649?
It affects 1 product.
Products include Linuxcontainers Lxc.
How do I fix CVE-2016-8649?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2016-8649 being exploited?
There is no known exploitation of CVE-2016-8649 in the wild and no public exploit code.
Other vulnerabilities in LXC before 1.0.9 and 2.x before 2.0.6
Sources
Also known as DEBIAN-CVE-2016-8649, GHSA-vp8j-2cg9-6pvv, UBUNTU-CVE-2016-8649, USN-3136-1.