PT-2019-5743 · Seccomp+1 · Libseccomp-Golang+1

Mheon · Published 2019-04-24 · Updated 2021-05-18 · CVE-2017-18367

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions libseccomp-golang versions 0.9.0 and earlier

Description The issue is related to the incorrect generation of BPFs by libseccomp-golang, where multiple arguments are ORed instead of ANDed. This allows a process to bypass intended access restrictions by specifying a single matching argument. The vulnerability is associated with an insufficient input validation mechanism, which can be exploited by a remote attacker to impact data integrity. Specifically, filters with rules containing multiple syscall arguments are improperly constructed, requiring all arguments to match instead of any of them, thus allowing bypass by specifying only a subset of the arguments.

Recommendations For libseccomp-golang versions 0.9.0 and earlier, consider restricting the use of seccomp filters with multiple syscall arguments until a patch is available. As a temporary workaround, avoid using filters that require multiple arguments to match, and instead, opt for filters that only require a single argument to match. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

RCE

Weakness Enumeration

CWE-284

CWE-20

Related Identifiers

BDU:2021-01286

CVE-2017-18367

DLA-2320-1

GHSA-58V3-J75H-XR49

GO-2020-0007

RHSA-2019:4087

RHSA-2020:2479

USN-4574-1

Affected Products

Ubuntu

Libseccomp-Golang

References · 20

• https://github.com/seccomp/libseccomp-golang/issues/22 · Patch
• https://github.com/seccomp/libseccomp-golang/commit/06e7a29f36a34b8cf419aeb87b979ee508e58f9e · Patch
• https://access.redhat.com/errata/RHSA-2019:4090 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-18367 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:4087 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2320-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01286 · Security Note
• https://usn.ubuntu.com/4574-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18367 · Security Note
• https://osv.dev/vulnerability/GO-2020-0007 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18367 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-18367 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4574-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-18367 · Vendor Advisory
• http://openwall.com/lists/oss-security/2019/04/25/6 · Patch