CVE-2016-8649: Critical severity linuxcontainers Lxc vulnerability
CVE-2016-8649 was assigned to the issue that allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls. The file descriptor is needed to write to /proc/<PID>/attr/current or /proc/<PID>/attr/exec to set the AppArmor/SELinux label of the attached process.
Upstream bug:
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1639345
Upstream patch:
https://github.com/lxc/lxc/commit/81f466d05f2a89cb4f122ef7f593ff3f279b165c
References:
http://seclists.org/oss-sec/2016/q4/515
Other sources
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8649?
CVE-2016-8649 is considered a high severity vulnerability due to its potential to allow attackers to access the host's filesystem.
How do I fix CVE-2016-8649?
To fix CVE-2016-8649, upgrade the lxc package to versions 1:2.0.6-1, 1:4.0.6-2+deb11u2, 1:5.0.2-1+deb12u2, or 1:6.0.1-1.
Which platforms are affected by CVE-2016-8649?
CVE-2016-8649 affects various versions of the lxc package on Debian and Linux Containers.
What is the impact of CVE-2016-8649 on system security?
CVE-2016-8649 compromises system security by enabling unprivileged containers to access sensitive files on the host.
Is there a workaround for CVE-2016-8649 if I cannot update?
A recommended workaround for CVE-2016-8649 is to limit access permissions for unprivileged containers until a fix can be applied.