GitHub Advisoryadvisory · Go

GHSA-gp4j-w3vj-7299 Information Exposure in RunC

MEDIUM Published 2021-12-20 Modified 2021-05-20 Official page ↗
Aliases
CVE-2016-9962
Ecosystem
Go
Packages
github.com/opencontainers/runc
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2021-05-20

Affected packages

• Go github.com/opencontainers/runc: < 1.0.0-rc3 → fixed in 1.0.0-rc3

Description

RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.

Related

Alias · CVE (1)

  • CVE-2016-9962 RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References