CVE-2016-8649

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	LXC before 1.0.9 and 2.x before 2.0.6	LXC before 1.0.9 and 2.x before 2.0.6

References

http://www.securityfocus.com/bid/94498Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845465Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1639345Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1398242Issue Tracking, Patch
https://github.com/lxc/lxc/commit/81f466d05f2a89cb4f122ef7f593ff3f279b165cPatch, Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2016-8649Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/94498Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845465Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1639345Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1398242Issue Tracking, Patch
https://github.com/lxc/lxc/commit/81f466d05f2a89cb4f122ef7f593ff3f279b165cPatch, Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2016-8649Third Party Advisory, VDB Entry

Timeline

Published: May 1, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-86505.5The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which CVE-2016-86513.5An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with a CVE-2016-86525.9The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) CVE-2016-86535.3It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could CVE-2016-86547.8A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versio CVE-2016-86557.8Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of servi CVE-2016-86567.8Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script which could result i CVE-2016-86577.8It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas con CVE-2016-86586.1Stack-based buffer overflow in the brcmf_cfg80211_start_ap function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Li CVE-2016-86597.0Bubblewrap before 0.1.3 sets the PR_SET_DUMPABLE flag, which might allow local users to gain privileges by attaching to the process, as demo CVE-2016-86605.5The XFS subsystem in the Linux kernel through 4.8.2 allows local users to cause a denial of service (fdatasync failure and system hang) by u CVE-2016-86618.4Little Snitch version 3.0 through 3.6.1 suffer from a buffer overflow vulnerability that could be locally exploited which could lead to an e