Summary
It was discovered that libseccomp-golang incorrectly generated BPF filters
for rules that specified multiple syscall arguments, matching any one of
the arguments instead of all of them. An attacker could possibly use this
issue to bypass intended seccomp restrictions.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | golang-github-seccomp-libseccomp-golang | 0.9.0-1ubuntu0.1~esm1 |
Vulnerabilities 1
-
Medium 4.8
Improper Input Validation in libseccomp-golang
libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by spec…
References
-
report
https://ubuntu.com/security/CVE-2017-18367