The lxc-sshd template (templates/lxc-sshd.in) in LXC before 1.0.0.beta2 uses read-write permissions when mounting /sbin/init, which allows local users to gain privileges by modifying the init file.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "1.0.0~beta2-0ubuntu1", "binary_name": "liblxc0" }, { "binary_version": "1.0.0~beta2-0ubuntu1", "binary_name": "lxc" }, { "binary_version": "1.0.0~beta2-0ubuntu1", "binary_name": "lxc-dbg" }, { "binary_version": "1.0.0~beta2-0ubuntu1", "binary_name": "lxc-dev" }, { "binary_version": "1.0.0~beta2-0ubuntu1", "binary_name": "lxc-templates" }, { "binary_version": "1.0.0~beta2-0ubuntu1", "binary_name": "lxc-tests" }, { "binary_version": "1.0.0~beta2-0ubuntu1", "binary_name": "python3-lxc" } ] }