GitHub Advisoryadvisory · Go

GHSA-58v3-j75h-xr49 Improper Input Validation in libseccomp-golang

HIGH Published 2021-05-18 Modified 2021-05-17 Official page ↗
Aliases
CVE-2017-18367
Ecosystem
Go
Packages
github.com/seccomp/libseccomp-golang
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-284
Reviewed
2021-05-17

Affected packages

• Go github.com/seccomp/libseccomp-golang: < 0.9.1 → fixed in 0.9.1

Description

libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.

Related

Alias · CVE (1)

  • CVE-2017-18367 libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References