Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2016-10124

Published: 9 January 2017

An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container.

Priority

Medium

Cvss 3 Severity Score

8.6

Score breakdown

Status

Package Release Status
lxc
Launchpad, Ubuntu, Debian
precise Ignored
(end of life)
trusty
Released (1.0.10-0ubuntu1.1)
upstream
Released (1:2.0.0-1)
xenial Not vulnerable
(2.0.7-0ubuntu1~16.04.2)
yakkety Not vulnerable
(2.0.7-0ubuntu1~16.10.2)
zesty Not vulnerable
(2.0.7-0ubuntu2)
Patches:
upstream: https://github.com/lxc/lxc/commit/e986ea3dfa4a2957f71ae9bfaed406dd6e1ffff6
upstream: https://github.com/lxc/lxc/commit/5eacdc3dbd0e45abf3cc90cf0216a7f8ee560abf

Severity score breakdown

Parameter Value
Base score 8.6
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Changed
Confidentiality None
Integrity impact High
Availability impact None
Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N