lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
No PoCs found on GitHub currently.