Cloudanix VulnDB

CVE-2016-8649

Critical · 9.1

CVSS

9.1

EPSS

2.8%

Published

May 1, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in container software lets an attacker who breaks into one container reach and control files on the main computer system outside it.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
Container Runtime
Class
Container Escape
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Allows an attacker within an unprivileged container to leverage an inherited file descriptor referencing the host's /proc filesystem to perform openat() syscalls that grant access to the host's entire filesystem, enabling container escape.

Why it matters to the business

A compromise of an unprivileged container can lead to full access to the host system, potentially allowing attackers to access sensitive data, execute arbitrary code on the host, or pivot to other systems. The vulnerability affects widely used container tools with many downstream dependents.

How an attack unfolds

An attacker who has gained access to an unprivileged LXC container can exploit lxc-attach to inherit a file descriptor for the host's /proc and use it to traverse and access the host filesystem via openat family calls, bypassing container isolation boundaries.

How to fix it

Upgrade LXC to 1.0.9 or newer for the 1.x series and 2.0.6 or newer for the 2.x series. Apply the exact fixes including commit 7b483176022ea1ae71fefbd67b46da9d9b6548b7 for lxc/lxc and version 0.15.1-r5 for ko-fips (Chainguard) packages.

How to confirm the fix worked

Confirm the running LXC version meets or exceeds the fixed releases listed. Audit container startup logs and test that processes inside containers cannot reach host paths outside their intended mount namespace.

Typical attack path

  1. Gain code execution inside an unprivileged LXC container
  2. Trigger lxc-attach or equivalent attach operation
  3. Reuse the inherited host /proc file descriptor with openat() syscalls
  4. Access and modify arbitrary host filesystem paths

How to detect it

Examine system call audit logs for openat() operations originating from container processes that reference host /proc paths. Correlate lxc-attach invocations with subsequent unexpected host file activity in unprivileged contexts.

What your security team should do

  • Upgrade all affected LXC packages to the specified fixed versions without delay
  • Harden container configurations to minimize inherited file descriptors
  • Implement runtime monitoring for unexpected host filesystem access from containers
  • Review and restrict use of lxc-attach in multi-tenant environments

The record

lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 lxc 0 1:2.0.6-1
Debian:12 lxc 0 1:2.0.6-1
Debian:13 lxc 0 1:2.0.6-1
Mageia:5 lxc 0 1.0.10-1.mga5
Ubuntu:14.04:LTS lxc 0 1.0.8-0ubuntu0.4
Ubuntu:16.04:LTS lxc 0 2.0.5-0ubuntu1~ubuntu16.04.3
openSUSE:Tumbleweed lxc 0 2.0.4-2.1

Related vulnerabilities