CVE-2016-10124

Published: Jan 9, 2017Modified: May 6, 2026

8.6

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 4.0

Source: NVD

Description

An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container.

Affected (1)

Products: Linuxcontainers: Lxc

Linuxcontainers

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linuxcontainers Lxc	Up to 2.0.0

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (10)

http://www.openwall.com/lists/oss-security/2014/12/15/5

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/09/03/5

Source: cve@mitre.org

http://www.securityfocus.com/bid/95404

Source: cve@mitre.org

https://github.com/lxc/lxc/commit/e986ea3dfa4a2957f71ae9bfaed406dd6e1ffff6

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://security.gentoo.org/glsa/201711-09

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2014/12/15/5

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2015/09/03/5

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/95404

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/lxc/lxc/commit/e986ea3dfa4a2957f71ae9bfaed406dd6e1ffff6

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://security.gentoo.org/glsa/201711-09

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.