CVE-2016-8649
CriticalSummary
The vulnerability in lxc-attach in LXC before version 1.0.9 and 2.x before version 2.0.6 allows an attacker inside an unprivileged container to use an inherited file descriptor from the host's /proc to access the rest of the host's filesystem via the openat() family of syscalls.
Risk Assessment
An attacker could gain unauthorized access to sensitive data on the host, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update LXC to version 1.0.9 or 2.0.6 and later to mitigate this vulnerability, as well as to restrict access to containers to minimize risk.
Original NVD description (English source)
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.