CVE-2016-3697: High severity Docker Docker vulnerability
Published Jun 1, 2016
·Updated
libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.
Affected Software
4 affected componentsFixes available
go/github.com/opencontainers/runc<0.1.0
0.1.0
Docker Docker<=1.11.1
linuxfoundation Runc<=0.0.9
openSUSE openSUSE=13.2
Remediation
Patch Available
Patch Available
Event History
Jun 1, 2016
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Dec 20, 2021
Advisory Published
06:21 PM
Frequently Asked Questions
1
What is the severity of CVE-2016-3697?
CVE-2016-3697 has a medium severity rating allowing local users to gain elevated privileges.
2
How do I fix CVE-2016-3697?
To remediate CVE-2016-3697, upgrade runC to version 0.1.0 or later and ensure Docker is updated to version 1.11.2 or later.
3
What systems are affected by CVE-2016-3697?
CVE-2016-3697 affects runC versions prior to 0.1.0 and Docker versions prior to 1.11.2.
4
Can CVE-2016-3697 be exploited remotely?
CVE-2016-3697 cannot be exploited remotely as it requires local access to the vulnerable system.
5
What impact does CVE-2016-3697 have on container security?
CVE-2016-3697 can lead to unauthorized privilege escalation within containers, compromising their security.