Bug 1411256 (CVE-2016-10124) - CVE-2016-10124 lxc: Escaping to parent session using TIOCSTI ioctl in lxc-attach
Summary: CVE-2016-10124 lxc: Escaping to parent session using TIOCSTI ioctl in lxc-attach
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-10124
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1411257
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-01-09 09:32 UTC by Adam Mariš
Modified: 2021-10-21 11:49 UTC (History)
3 users (show)

Fixed In Version: lxc 2.0.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-21 11:49:13 UTC

Attachments (Terms of Use)

Description Adam Mariš 2017-01-09 09:32:26 UTC 
An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container.

External References:

https://github.com/lxc/lxc/commit/e986ea3dfa4a2957f71ae9bfaed406dd6e1ffff6
Comment 1 Adam Mariš 2017-01-09 09:32:50 UTC 
Created lxc tracking bugs for this issue:

Affects: epel-all [bug 1411257]
Comment 2 Fedora Update System 2017-07-30 19:46:37 UTC 
lxc-1.0.10-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2017-07-30 19:50:30 UTC 
lxc-1.0.10-2.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.