CVE-2017-18367: Input Validation
Last updated 26 August 2025
Other sources
libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/atomic-openshiftto a version that resolves this vulnerability.Fixed in 0:3.11.232-1.git.0.a5bc32f.el7 - Upgrade
Upgrade
redhat/openshiftto a version that resolves this vulnerability.Fixed in 0:4.1.27-201912021146.git.0.a40116f.el8_0 - Upgrade
Upgrade
redhat/libseccomp-golangto a version that resolves this vulnerability.Fixed in 0.9.1 - Upgrade
Upgrade
debian/golang-github-seccomp-libseccomp-golangto a version that resolves this vulnerability.Fixed in 0.9.1-2Fixed in 0.10.0-3Fixed in 0.10.0-4 - Upgrade
Upgrade
ubuntu/golang-github-seccomp-libseccomp-golangto a version that resolves this vulnerability.Fixed in 0.0~git20150813.0.1b506fc-2+deb9u1build0.16.04.1 - Upgrade
Upgrade
ubuntu/golang-github-seccomp-libseccomp-golangto a version that resolves this vulnerability.Fixed in 0.9.0-1ubuntu0.1~esm1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
Which deployments should be prioritized for review?
Prioritize deployments using libseccomp-golang 0.9.0 or earlier where a restrictive seccomp policy applies more than one argument condition to a syscall. The listed affected ecosystem packages include Ubuntu and Debian golang-github-seccomp-libseccomp-golang, Red Hat libseccomp-golang, Atomic OpenShift, and OpenShift.
What does an attacker need to bypass the intended policy?
The affected process must be running under a restrictive seccomp filter with multiple syscall-argument constraints. A bypass is possible when the process specifies one argument that matches one of those constraints, rather than satisfying all intended argument constraints.
How can we determine whether an existing filter is at risk?
Review generated seccomp BPF policies for syscall rules that contain multiple argument comparisons, and identify whether the deployed library is version 0.9.0 or earlier. Filters without multiple syscall-argument restrictions are not described as affected by this issue.