CVE-2018-9862: High severity hyper Runv Docker vulnerability
util.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain root access by leveraging the presence of an initial numeric value on an /etc/passwd line, and then issuing a "docker exec" command with that value in the -u argument, a similar issue to CVE-2016-3697.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-9862?
CVE-2018-9862 is classified as a high severity vulnerability due to the potential for unauthorized root access.
How can I fix CVE-2018-9862?
To fix CVE-2018-9862, it is recommended to upgrade to a version of Docker that does not use runV 1.0.0 or to apply relevant security patches.
Who is affected by CVE-2018-9862?
CVE-2018-9862 affects users of Docker utilizing runV version 1.0.0 with numeric usernames in the /etc/passwd file.
What kind of access does CVE-2018-9862 allow attackers?
CVE-2018-9862 allows attackers to gain root access by exploiting vulnerabilities in the handling of numeric usernames.
What is the primary cause of CVE-2018-9862?
The primary cause of CVE-2018-9862 is the mishandling of numeric usernames within the util.c component of runV.