Description
An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container.
References (5)
Core 5
Core References
Mailing List x_refsource_misc
http://www.openwall.com/lists/oss-security/2014/12/15/5
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/95404
Mailing List x_refsource_misc
http://www.openwall.com/lists/oss-security/2015/09/03/5
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/201711-09
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/lxc/lxc/commit/e986ea3dfa4a2957f71ae9bfaed406dd6e1ffff6
Scores
CVSS v3
8.6
EPSS
0.0153
EPSS Percentile
71.7%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Details
CWE
CWE-284
Status
published
Products (1)
linuxcontainers/lxc
< 2.0.0
Published
Jan 09, 2017
Tracked Since
Feb 18, 2026