Vulnerability Description
RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Docker | Docker | >= 1.11.0, < 1.12.6 |
Related Weaknesses (CWE)
References
- http://rhn.redhat.com/errata/RHSA-2017-0116.html
- http://rhn.redhat.com/errata/RHSA-2017-0123.html
- http://rhn.redhat.com/errata/RHSA-2017-0127.html
- http://seclists.org/fulldisclosure/2017/Jan/21Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2017/Jan/29Mailing ListThird Party Advisory
- http://www.securityfocus.com/archive/1/540001/100/0/threaded
- http://www.securityfocus.com/bid/95361Third Party AdvisoryVDB Entry
- https://access.redhat.com/security/vulnerabilities/cve-2016-9962Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1012568#c6Issue Tracking
- https://github.com/docker/docker/releases/tag/v1.12.6Vendor Advisory
- https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3dacde2PatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2016-9962?
CVE-2016-9962 is a vulnerability with a CVSS score of 6.4 (MEDIUM). RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-de...
How severe is CVE-2016-9962?
CVE-2016-9962 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-9962?
Check the references section above for vendor advisories and patch information. Affected products include: Docker Docker.