Summary
It was discovered that libseccomp-golang did not properly generate BPFs. If
a process were running under a restrictive seccomp filter that specified
multiple syscall arguments, the application could potentially bypass the
intended restrictions put in place by seccomp.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | golang-github-seccomp-libseccomp-golang | 0.0~git20150813.0.1b506fc-2+deb9u1build0.16.04.1 |
Vulnerabilities 1
-
Medium 4.8
Improper Input Validation in libseccomp-golang
libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by spec…
References
-
report
https://ubuntu.com/security/CVE-2017-18367