Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status

LXC: Remote security bypass — GLSA 201711-09

A vulnerability in LXC may lead to an unauthorized security bypass.

Affected packages

Package app-emulation/lxc on all architectures
Affected versions < 2.0.7
Unaffected versions >= 2.0.7

Background

LinuX Containers userspace utilities

Description

Previous versions of lxc-attach ran a shell or the specified command without allocating a pseudo terminal making it vulnerable to input faking via a TIOCSTI ioctl call.

Impact

Remote attackers can escape the container and perform unauthorized modifications.

Workaround

There is no know workaround at this time.

Resolution

All LXC users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-emulation/lxc-2.0.7"

References

Release date
November 11, 2017

Latest revision
November 11, 2017: 1

Severity
normal

Exploitable
remote

Bugzilla entries