CVE-2016-3697 Privilege Elevation in runc
HighCVSS 7.8
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opencontainers runc(Go) | < 0.1.0 | 0.1.0 |
| debian/runc(Debian:12) | < 0.1.0+dfsg-1 | 0.1.0+dfsg-1 |
| debian/runc(Debian:13) | < 0.1.0+dfsg-1 | 0.1.0+dfsg-1 |
| debian/runc(Debian:14) | < 0.1.0+dfsg-1 | 0.1.0+dfsg-1 |
| docker github.com/docker/docker | <= 1.11.1 | No fix listed |
| linuxfoundation runc | <= 0.0.9 | No fix listed |
| opensuse | = 13.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- lists.opensuse.org
- rhn.redhat.com
- rhn.redhat.com
- GLSA-201612-28 third-party-advisory vendor-advisory
- pkg.go.dev
- RHSA-2016:1034 third-party-advisory vendor-advisory
- RHSA-2016:2634 third-party-advisory vendor-advisory
- github.com
- github.com product
- Debian Security Tracker CVE-2016-3697 vendor-advisory
- openSUSE-SU-2016:1417 mailing-list third-party-advisory vendor-advisory