CVE-2016-3697 Privilege Elevation in runc
Local attackers can gain privileges by exploiting improper UID handling in the Docker runtime's user lookup logic.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-3697?
CVE-2016-3697 is a high-severity vulnerability in Opensuse Opensuse, published on 1 Jun 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.
Weakness: CWE-264
Which versions are affected by CVE-2016-3697?
3 open source packages ship an affected version, including github.com/opencontainers/runc. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/opencontainers/runc Go | All versions | 0.1.0 |
github.com/opencontainers/runc Go | All versions | 0.1.0 |
github.com/opencontainers/runc Go | All versions | 0.1.0 |
Linux distribution packages (15)
docker Red Hat:rhel_extras_other:7 | All versions | 0:1.10.3-57.el7 |
docker Red Hat:rhel_extras_other:7 | All versions | 0:1.9.1-40.el7 |
docker-common Red Hat:rhel_extras_other:7 | All versions | 0:1.10.3-57.el7 |
docker-common Red Hat:rhel_extras_other:7 | All versions | 0:1.9.1-40.el7 |
docker-forward-journald Red Hat:rhel_extras_other:7 | All versions | 0:1.9.1-40.el7 |
docker-logrotate Red Hat:rhel_extras_other:7 | All versions | 0:1.10.3-57.el7 |
docker-logrotate Red Hat:rhel_extras_other:7 | All versions | 0:1.9.1-40.el7 |
docker-lvm-plugin Red Hat:rhel_extras_other:7 | All versions | 0:1.10.3-57.el7 |
docker-novolume-plugin Red Hat:rhel_extras_other:7 | All versions | 0:1.10.3-57.el7 |
docker-rhel-push-plugin Red Hat:rhel_extras_other:7 | All versions | 0:1.10.3-57.el7 |
docker-selinux Red Hat:rhel_extras_other:7 | All versions | 0:1.10.3-57.el7 |
docker-selinux Red Hat:rhel_extras_other:7 | All versions | 0:1.9.1-40.el7 |
docker-v1.10-migrator Red Hat:rhel_extras_other:7 | All versions | 0:1.10.3-57.el7 |
docker SUSE:Linux Enterprise Module for Containers 12 | All versions | 1.10.3-66.1 |
docker SUSE:OpenStack Cloud 6 | All versions | 1.10.3-66.1 |
Products include Docker Docker, Linuxfoundation Runc, Opensuse Opensuse.
How do I fix CVE-2016-3697?
Upgrade github.com/opencontainers/runc to 0.1.0 or later.
Is CVE-2016-3697 being exploited?
There is no known exploitation of CVE-2016-3697 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Opensuse
Sources
Also known as DEBIAN-CVE-2016-3697, GHSA-q3j5-32m5-58c2, GO-2021-0070, MGASA-2016-0209, RHSA-2016:1034, RHSA-2016:2634 and 1 more.