6.4 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.4 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
27.6%
Issue Overview:
It was discovered that runC allowed additional container processes via runc exec
to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file descriptors of these new processes during the initialization, which can lead to container escapes or modification of runC state before the process is fully placed inside the container.
Affected Packages:
docker
Issue Correction:
Run yum update docker to update your system.
New Packages:
noarch:
docker-devel-1.12.6-1.17.amzn1.noarch
docker-pkg-devel-1.12.6-1.17.amzn1.noarch
src:
docker-1.12.6-1.17.amzn1.src
x86_64:
docker-1.12.6-1.17.amzn1.x86_64
docker-debuginfo-1.12.6-1.17.amzn1.x86_64
Red Hat: CVE-2016-9962
Mitre: CVE-2016-9962
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Amazon Linux | 1 | noarch | docker-devel | < 1.12.6-1.17.amzn1 | docker-devel-1.12.6-1.17.amzn1.noarch.rpm |
Amazon Linux | 1 | noarch | docker-pkg-devel | < 1.12.6-1.17.amzn1 | docker-pkg-devel-1.12.6-1.17.amzn1.noarch.rpm |
Amazon Linux | 1 | x86_64 | docker | < 1.12.6-1.17.amzn1 | docker-1.12.6-1.17.amzn1.x86_64.rpm |
Amazon Linux | 1 | x86_64 | docker-debuginfo | < 1.12.6-1.17.amzn1 | docker-debuginfo-1.12.6-1.17.amzn1.x86_64.rpm |
6.4 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.4 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
27.6%