CVE-2016-8649

Severity: critical (CVSS 9.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-05-01 · updated 2026-06-17
Weakness: CWE-264

Description

lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.

Affected products

lxc: before 1.0.9; from 2.0.0 before 2.0.6 — fixed in 1.0.9, 2.0.6

How to fix

Upgrade to a fixed version: lxc 1.0.9, 2.0.6. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/94498
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845465
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1639345
https://bugzilla.redhat.com/show_bug.cgi?id=1398242
https://github.com/lxc/lxc/commit/81f466d05f2a89cb4f122ef7f593ff3f279b165c
https://security-tracker.debian.org/tracker/CVE-2016-8649
http://www.securityfocus.com/bid/94498
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845465
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1639345
https://bugzilla.redhat.com/show_bug.cgi?id=1398242
https://github.com/lxc/lxc/commit/81f466d05f2a89cb4f122ef7f593ff3f279b165c
https://security-tracker.debian.org/tracker/CVE-2016-8649

Get alerted when CVE-2016-8649 or the next vulnerability affects your stack