CVE-2016-10124

An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container.

CVSS v3 8.6 HIGH
CVSS v2.0 5.0 MEDIUM

8.6^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.openwall.com/lists/oss-security/2014/12/15/5
http://www.openwall.com/lists/oss-security/2015/09/03/5
http://www.securityfocus.com/bid/95404
https://github.com/lxc/lxc/commit/e986ea3dfa4a2957f71ae9bfaed406dd6e1ffff6	Issue Tracking Patch Third Party Advisory
https://security.gentoo.org/glsa/201711-09

Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxcontainers:lxc:*:rc1:*:*:*:*:*:*

History

No history.

Information

Published : 2017-01-09 08:59

Updated : 2024-02-28 15:44

NVD link : CVE-2016-10124

Mitre link : CVE-2016-10124

CVE.ORG link : CVE-2016-10124

JSON object : View

Products Affected

linuxcontainers

lxc

CWE

CWE-284

Improper Access Control

{"id": "CVE-2016-10124", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2017-01-09T08:59:00.153", "references": [{"url": "http://www.openwall.com/lists/oss-security/2014/12/15/5", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2015/09/03/5", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/95404", "source": "cve@mitre.org"}, {"url": "https://github.com/lxc/lxc/commit/e986ea3dfa4a2957f71ae9bfaed406dd6e1ffff6", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.gentoo.org/glsa/201711-09", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container."}, {"lang": "es", "value": "Se ha descubierto un problema en Linux Containers (LXC) en versiones anteriores a 22-02-2016. Cuando se ejecuta un programa a trav\u00e9s de lxc-attach, la sesi\u00f3n no privada puede escapar a la sesi\u00f3n parental utilizando el ioctl TIOCSTI para presionar caracteres en el b\u00fafer de entrada del terminal, permitiendo a un atacante escapar del contenedor."}], "lastModified": "2017-11-13T02:29:00.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxcontainers:lxc:*:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "174CEA20-CA6F-44BE-AC6F-301CE073C7EE", "versionEndIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}