Bugzilla – Bug 1018892
VUL-0: CVE-2016-10124: lxc: escape to parent session via TIOCSTI ioctl in lxc-attach
Last modified: 2017-07-28 14:51:30 UTC
lxec when executing a program via lxc-attach, a nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container. https://github.com/lxc/lxc/pull/825 https://github.com/lxc/lxc/commit/cee1de17853511bea4e7e0a99de3649b5eed176e optional: https://github.com/lxc/lxc/pull/835 https://github.com/lxc/lxc/commit/82d97f87655222524ad583033b0ec9b778e2ddbc related: https://github.com/lxc/lxc/pull/839 https://github.com/lxc/lxc/commit/b5c8400909b863bd4b260fa45a947f652c83d5fd related? https://github.com/lxc/lxc/pull/849 https://github.com/lxc/lxc/commit/ad6ea0348c1476a9c57bdd6e25ddb08728a5453a doc: https://github.com/lxc/lxc/commit/e986ea3dfa4a2957f71ae9bfaed406dd6e1ffff6 https://github.com/lxc/lxc/commit/b5c8400909b863bd4b260fa45a947f652c83d5fd References: https://bugzilla.redhat.com/show_bug.cgi?id=1411256 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10124 https://github.com/lxc/lxc/commit/e986ea3dfa4a2957f71ae9bfaed406dd6e1ffff6
bugbot adjusting priority
There is way too much difference between lxc master and our latest supported version (0.8.0) in SLES. This series can't be backported.
we have several TIOCSTI bugs ... bug 968674 is the one with some thoughts on how to address it. But there is no good solution at this time in general.
The part setsid(); if (ioctl(slave, TIOCSCTTY, NULL) < 0) would be the core of the fix... so there is an approach, just the patch is very large :/
Andreas, I'm not planning to backport such a giant thing to the super old lxc that we have on SLE 11. It would be rather risky and complex. Could this bug be closed?
(In reply to Cédric Bosdonnat from comment #5) No, unfortunately not. It's supported, so we need to fix it. Maybe we can go the route that Marcus proposed and use a minimal patch?
I'll prepare packages for openSUSE in the meantime, but my last submit request is still open...
This scenario is not supported in SLE 11 (see release notes) and fixing it would be a major effort and a high risk of introducing regression.s