CVE-2016-8649
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged...
CVE-2016-8649 is a critical vulnerability (CVSS 9.1) in Linuxcontainers Lxc, published November 23, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.81%, the 86th percentile. Fixed in lxc 1:2.0.6-1.
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.
- Record
CVE-2016-8649- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.
- Record
CVE-2016-8649- Updated
- 2026-11-02
EUVDEUVD-2016-9488 No score
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.
- Record
EUVD-2016-9488- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vp8j-2cg9-6pvv
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged...
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.
- Record
GHSA-vp8j-2cg9-6pvv- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.
- Record
CVE-2016-8649- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-8649
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.
- Record
DEBIAN-CVE-2016-8649- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2016-8649
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.
- Record
UBUNTU-CVE-2016-8649- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0167 No score
Updated lxc packages fix security vulnerabilities
Roman Fiedler discovered a directory traversal flaw in lxc-attach. An attacker with access to an LXC container could exploit this flaw to access files outside of the container (CVE-2016-8649).
Jann Horn discovered that LXC incorrectly verified permissions when creating virtual network interfaces. A local attacker could possibly use this issue to create virtual network interfaces in network namespaces that they do not own (CVE-2017-5985).
The lxc package has been updated to version 1.0.10 to fix these issues and other bugs.
- Record
MGASA-2017-0167- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10416-1 No score
liblxc-devel-2.0.4-2.1 on GA media
These are all security issues fixed in the liblxc-devel-2.0.4-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10416-1- Updated
- 2026-11-02
OSVUSN-3136-1 No score
lxc vulnerability
Roman Fiedler discovered a directory traversal flaw in lxc-attach. An attacker with access to an LXC container could exploit this flaw to access files outside of the container.
- Record
USN-3136-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lxcDebian:12 |
before 1:2.0.6-1 | 1:2.0.6-1 |
lxcDebian:13 |
before 1:2.0.6-1 | 1:2.0.6-1 |
lxcDebian:14 |
before 1:2.0.6-1 | 1:2.0.6-1 |
lxcMageia:5 |
before 1.0.10-1.mga5 | 1.0.10-1.mga5 |
lxcUbuntu:14.04:LTS |
before 1.0.8-0ubuntu0.4, plus listed versions 1.0.0~alpha1-0ubuntu111.0.0~alpha2-0ubuntu11.0.0~alpha2-0ubuntu31.0.0~alpha2-0ubuntu41.0.0~alpha2-0ubuntu5 Show 41 moreShow less1.0.0~alpha2-0ubuntu61.0.0~alpha3-0ubuntu11.0.0~alpha3-0ubuntu21.0.0~alpha3-0ubuntu31.0.0~alpha3-0ubuntu41.0.0~alpha3-0ubuntu51.0.0~alpha3-0ubuntu61.0.0~alpha3-0ubuntu71.0.0~alpha3-0ubuntu81.0.0~beta1-0ubuntu11.0.0~beta1-0ubuntu21.0.0~beta1-0ubuntu31.0.0~beta2-0ubuntu11.0.0~beta2-0ubuntu21.0.0~beta3-0ubuntu11.0.0~beta4-0ubuntu11.0.0~beta4-0ubuntu21.0.0~rc1-0ubuntu21.0.0~rc3-0ubuntu11.0.0~rc4-0ubuntu11.0.0-0ubuntu11.0.0-0ubuntu21.0.0-0ubuntu31.0.0-0ubuntu41.0.1-0ubuntu11.0.2-0ubuntu11.0.2-0ubuntu21.0.3-0ubuntu11.0.3-0ubuntu21.0.3-0ubuntu31.0.4-0ubuntu0.11.0.5-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.11.0.7-0ubuntu0.21.0.7-0ubuntu0.51.0.7-0ubuntu0.61.0.7-0ubuntu0.71.0.7-0ubuntu0.91.0.7-0ubuntu0.101.0.8-0ubuntu0.3 |
1.0.8-0ubuntu0.4 |
lxcUbuntu:16.04:LTS |
before 2.0.5-0ubuntu1~ubuntu16.04.3, plus listed versions 1.1.4-0ubuntu11.1.4-0ubuntu1.11.1.4-0ubuntu31.1.5-0ubuntu11.1.5-0ubuntu2 Show 27 moreShow less1.1.5-0ubuntu31.1.5-0ubuntu41.1.5-0ubuntu51.1.5-0ubuntu62.0.0~beta2-0ubuntu22.0.0~rc1-0ubuntu12.0.0~rc2-0ubuntu22.0.0~rc3-0ubuntu12.0.0~rc3-0ubuntu22.0.0~rc3-0ubuntu32.0.0~rc4-0ubuntu12.0.0~rc5-0ubuntu12.0.0~rc9-0ubuntu12.0.0~rc10-0ubuntu12.0.0~rc10-0ubuntu22.0.0~rc11-0ubuntu12.0.0~rc12-0ubuntu12.0.0~rc13-0ubuntu22.0.0~rc14-0ubuntu22.0.0~rc15-0ubuntu12.0.0-0ubuntu12.0.0-0ubuntu22.0.1-0ubuntu1~16.04.12.0.3-0ubuntu1~ubuntu16.04.12.0.4-0ubuntu1~ubuntu16.04.22.0.5-0ubuntu1~ubuntu16.04.12.0.5-0ubuntu1~ubuntu16.04.2 |
2.0.5-0ubuntu1~ubuntu16.04.3 |
lxcopenSUSE:Tumbleweed |
before 2.0.4-2.1 | 2.0.4-2.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugzilla.redhat.com/show_bug.cgi?id=1398242
bugs.launchpad.net/ubuntu/+source/lxc/+bug/1639345
github.com/lxc/lxc/commit/81f466d05f2a89cb4f122ef7f593ff3f279b165c
bugs.debian.org/cgi-bin/bugreport.cgi?bug=845465
security-tracker.debian.org/tracker/CVE-2016-8649
securityfocus.com/bid/94498
Show 15 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-8649
advisories.mageia.org/MGASA-2017-0167.html
bugs.mageia.org/show_bug.cgi?id=20439
linuxcontainers.org/lxc/news
ubuntu.com/usn/usn-3136-1
ubuntu.com/security/CVE-2016-8649
cve.org/CVERecord?id=CVE-2016-8649
suse.com/security/cve/CVE-2015-1331