UBUNTU-CVE-2017-18367: High severity ubuntu/golang-github-seccomp-libseccomp-golang vulnerability

Q: Which deployments are exposed to this issue?

Deployments are exposed when they use libseccomp-golang 0.9.0 or earlier to generate a restrictive seccomp filter containing multiple argument conditions for a syscall. Filters without multiple syscall-argument conditions are not identified as affected by the provided information.

Q: What must an attacker be able to do to bypass a policy?

The attacker must be able to run a process subject to the affected seccomp filter and invoke a syscall covered by multiple argument restrictions. Supplying one argument that matches one of the configured conditions can bypass the intended combined restriction.

Q: How can I determine whether an existing filter is at risk?

Check whether the filter was generated with libseccomp-golang 0.9.0 or earlier and whether any syscall rule specifies multiple argument constraints. Such rules may have been compiled so that the constraints are ORed instead of requiring all of them to match.

Published Apr 24, 2019

Updated

libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.

Affected Software

2 affected componentsFixes available

ubuntu/golang-github-seccomp-libseccomp-golang<0.0~git20150813.0.1b506fc-2+deb9u1build0.16.04.1

0.0~git20150813.0.1b506fc-2+deb9u1build0.16.04.1

ubuntu/golang-github-seccomp-libseccomp-golang<0.9.0-1ubuntu0.1~esm1

0.9.0-1ubuntu0.1~esm1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/golang-github-seccomp-libseccomp-golang to a version that resolves this vulnerability.
Fixed in 0.0~git20150813.0.1b506fc-2+deb9u1build0.16.04.1
Upgrade
Upgrade ubuntu/golang-github-seccomp-libseccomp-golang to a version that resolves this vulnerability.
Fixed in 0.9.0-1ubuntu0.1~esm1

Event History

Apr 24, 2019

CVE Published

via OSV·09:29 PM

Data Sourced

via OSV·09:29 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments are exposed when they use libseccomp-golang 0.9.0 or earlier to generate a restrictive seccomp filter containing multiple argument conditions for a syscall. Filters without multiple syscall-argument conditions are not identified as affected by the provided information.

What must an attacker be able to do to bypass a policy?

The attacker must be able to run a process subject to the affected seccomp filter and invoke a syscall covered by multiple argument restrictions. Supplying one argument that matches one of the configured conditions can bypass the intended combined restriction.

How can I determine whether an existing filter is at risk?

Check whether the filter was generated with libseccomp-golang 0.9.0 or earlier and whether any syscall rule specifies multiple argument constraints. Such rules may have been compiled so that the constraints are ORed instead of requiring all of them to match.

UBUNTU-CVE-2017-18367: High severity ubuntu/golang-github-seccomp-libseccomp-golang vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to bypass a policy?

How can I determine whether an existing filter is at risk?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to bypass a policy?

How can I determine whether an existing filter is at risk?