Bug 1411256 (CVE-2016-10124)

Summary: CVE-2016-10124 lxc: Escaping to parent session using TIOCSTI ioctl in lxc-attach
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: karlthered, pokorra.mailinglists, sagarun, thomas.moschny
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: lxc 2.0.0 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1411257    
Bug Blocks:    

Description Adam Mariš 2017-01-09 09:32:26 UTC
An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container.

External References:

https://github.com/lxc/lxc/commit/e986ea3dfa4a2957f71ae9bfaed406dd6e1ffff6

Comment 1 Adam Mariš 2017-01-09 09:32:50 UTC
Created lxc tracking bugs for this issue:

Affects: epel-all [bug 1411257]

Comment 2 Fedora Update System 2017-07-30 19:46:37 UTC
lxc-1.0.10-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2017-07-30 19:50:30 UTC
lxc-1.0.10-2.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.