CVE-2016-10124: Improper Access Control (CWE-284)
value: An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 8.6
Published: 2017-01-09T08:59Z
Repository: https://github.com/lxc/lxc
Language: Other
Files changed: doc/lxc-attach.sgml.in
Commit date: 2016-02-22 23:23:58 +0100
Commit message: update lxc-attach manpage

- explain rationale behind allocation of pty
- briefly explain how a pty is allocated
- add a short note that describes the changed behavior for lxc-attach when the
  user is not placed in a writeable cgroup at login

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>

Diff: diff --git a/doc/lxc-attach.sgml.in b/doc/lxc-attach.sgml.in
index 8535c3df6..653ce1d9b 100644
--- a/doc/lxc-attach.sgml.in
+++ b/doc/lxc-attach.sgml.in
@@ -76,10 +76,27 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
       <command>lxc-attach</command> will be looked up inside the
       container and executed. This will fail if no such user exists
       inside the container or the container does not have a working
       nsswitch mechanism.
     </para>
+    <para>
+    Previous versions of <command>lxc-attach</command> simply attached to the
+    specified namespaces of a container and ran a shell or the specified
+    command without allocating a pseudo terminal. This made them vulnerable to
+    input faking via a TIOCSTI <command>ioctl</command> call after switching
+    between userspace execution contexts with different privilegel levels. Newer
+    versions of <command>lxc-attach</command> will try to allocate a pseudo
+    terminal master/slave pair and attach any standard file descriptors which
+    refer to a terminal to the slave side of the pseudo terminal before
+    executing a shell or command. <command>lxc-attach</command> will first try
+    to allocate a pseudo terminal in the container. Should this fail it will try
+    to allocate a pseudo terminal on the host before finally giving up. Note,
+    that if none of the standard file descriptors refer to a terminal
+    <command>lxc-attach</command> will not try to allocate a pseudo terminal.
+    Instead it will simply attach to the containers namespaces and run a shell
+    or the specified command.
+    </para>
 
   </refsect1>
 
   <refsect1>
 
@@ -309,10 +326,20 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
       does) before this is done, esentially giving the process a new
       mount namespace, which is identical to the hosts's mount namespace
       except for the <replaceable>/proc</replaceable> and
       <replaceable>/sys</replaceable> filesystems.
     </para>
+    <para>
+      Previous versions of <command>lxc-attach</command> suffered a bug whereby
+      a user could attach to a containers namespace without being placed in a
+      writeable cgroup for some critical subsystems. Newer versions of
+      <command>lxc-attach</command> will check whether a user is in a writeable
+      cgroup for those critical subsystems. <command>lxc-attach</command> might
+      thus fail unexpectedly for some users (E.g. on systems where an
+      unprivileged user is not placed in a writeable cgroup in critical
+      subsystems on login.). However, this behavior is correct and more secure.
+    </para>
   </refsect1>
 
   <refsect1>
     <title>Security</title>
     <para>

Fixed code:     <para>
    Previous versions of <command>lxc-attach</command> simply attached to the
    specified namespaces of a container and ran a shell or the specified
    command without allocating a pseudo terminal. This made them vulnerable to
    input faking via a TIOCSTI <command>ioctl</command> call after switching
    between userspace execution contexts with different privilegel levels. Newer
    versions of <command>lxc-attach</command> will try to allocate a pseudo
    terminal master/slave pair and attach any standard file descriptors which
    refer to a terminal to the slave side of the pseudo terminal before
    executing a shell or command. <command>lxc-attach</command> will first try
    to allocate a pseudo terminal in the container. Should this fail it will try
    to allocate a pseudo terminal on the host before finally giving up. Note,
    that if none of the standard file descriptors refer to a terminal
    <command>lxc-attach</command> will not try to allocate a pseudo terminal.
    Instead it will simply attach to the containers namespaces and run a shell
    or the specified command.
    </para>
    <para>
      Previous versions of <command>lxc-attach</command> suffered a bug whereby
      a user could attach to a containers namespace without being placed in a
      writeable cgroup for some critical subsystems. Newer versions of
      <command>lxc-attach</command> will check whether a user is in a writeable
      cgroup for those critical subsystems. <command>lxc-attach</command> might
      thus fail unexpectedly for some users (E.g. on systems where an
      unprivileged user is not placed in a writeable cgroup in critical
      subsystems on login.). However, this behavior is correct and more secure.
    </para>