CVE-2016-8649: Linuxcontainers Lxc

Critical severity, CVSS 9.1. EPSS: 2.8% chance of exploitation in the next 30 days.

lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.

Affected products

• Linuxcontainers Lxc: before 1.0.9 (fixed in 1.0.9); from 2.0.0, before 2.0.6 (fixed in 2.0.6)

Published 2017-05-01. Last modified 2026-06-17.