CVE-2016-3096: High severity red hat fedora vulnerability
A vulnerability in lxccontainer, ansible module, was found allowing to get root inside the container. The problem is in the createscript function, which tries to write to /opt/.lxc-attach-script inside of the container. If the attacker can write to /opt/.lxc-attach-script before that, he can overwrite arbitrary files or execute commands as root.
Other sources
The createscript function in the lxccontainer module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archivepath directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.
— GitHub
The createscript function in the lxccontainer module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archivepath directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3096?
CVE-2016-3096 is considered a critical vulnerability due to its potential to allow unauthorized root access inside containers.
How do I fix CVE-2016-3096?
To fix CVE-2016-3096, upgrade the ansible package to version 2.0.2.0 or 1.9.6.1 or later.
What versions of ansible are affected by CVE-2016-3096?
Affected versions of ansible include 1.9.6 and earlier, and 2.0.1.0 and earlier.
What products are impacted by CVE-2016-3096?
CVE-2016-3096 impacts the ansible modules within Fedora versions 22, 23, and 24.
What is the exploit method for CVE-2016-3096?
The exploit method for CVE-2016-3096 involves manipulating the create_script function to gain unauthorized access to write in a specific script location.