650 matches found
AlmaLinux 9 : oci-seccomp-bpf-hook (ALSA-2026:36617)
The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:36617 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block directl...
RHSA-2026:36617 Red Hat Security Advisory: oci-seccomp-bpf-hook security update
Bulletin has no description...
Important: Red Hat Security Advisory: oci-seccomp-bpf-hook security update
An update for oci-seccomp-bpf-hook is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
ALSA-2026:36617 Important: oci-seccomp-bpf-hook security update
OCI Hook to generate seccomp json files based on EBF syscalls used by container oci-seccomp-bpf-hook provides a library for applications looking to use the Container Pod concept popularized by Kubernetes. Security Fixes: net: golang: Go net package: Denial of Service via long CNAME response in...
RHEL 9 : oci-seccomp-bpf-hook (RHSA-2026:36617)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:36617 advisory. OCI Hook to generate seccomp json files based on EBF syscalls used by container oci-seccomp-bpf-hook provides a library for applications looking to...
oci-seccomp-bpf-hook security update
1.2.11-2 - rebuild for CVE-2026-33811 Resolves: RHEL-187325...
Important: oci-seccomp-bpf-hook security update
OCI Hook to generate seccomp json files based on EBF syscalls used by container oci-seccomp-bpf-hook provides a library for applications looking to use the Container Pod concept popularized by Kubernetes. Security Fixes: net: golang: Go net package: Denial of Service via long CNAME response in...
container-tools:ol8 security, bug fix, and enhancement update
aardvark-dns 2:1.10.1-2 - build off the RHEL maintenance branch - Resolves: RHEL-59129 buildah 2:1.33.14-3 - rebuild for CVE-2025-68121 - Resolves: RHEL-149262 cockpit-podman 84.1-1 - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/84.1 - Related: Jira:RHEL-25557 conmon...
pagecache-lpe-containment-kit
Page-Cache LPE Containment Kit Detect, contain, and verify...
GHSA-M8J6-RC5X-WV36 nono-py's policy JSON accepts unknown security fields
Summary nono-py policy handling could fail open in two ways. First, resolving a policy-derived ProxyConfig did not automatically enforce CapabilitySet.proxyonly, allowing sandboxed children to bypass a resolved domain allowlist by using direct network access. Second, policy JSON accepted unknown...
GO-2026-5664 netfoil's optional seccomp sandboxing was not applied in github.com/tinfoil-factory/netfoil
netfoil's optional seccomp sandboxing was not applied in github.com/tinfoil-factory/netfoil...
nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`
Summary The nono Landlock/seccomp policies allow access to local Unix domain sockets concrete and abstract. This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Threat scenario: Running Aider, Claude Code, OpenCode or similar tools with "allow bash" policy so that it...
PT-2026-44549
Name of the Vulnerable Software and Affected Versions nono versions prior to 0.55.0 Description Landlock and seccomp policies in the software allow access to local Unix domain sockets, including both concrete and abstract types. This flaw enables a sandbox escape by allowing a process to...
GHSA-2GV2-CFFP-J227 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs
Summary In the runtime-rs standalone virtio-fs path, verified here with QEMU and verified with Cloud Hypervisor too, Kata Containers runs host virtiofsd as root with: --sandbox none --seccomp none If an attacker has root-equivalent execution inside the Kata guest VM, they can send raw FUSE reques...
Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs
Summary In the runtime-rs standalone virtio-fs path, verified here with QEMU and verified with Cloud Hypervisor too, Kata Containers runs host virtiofsd as root with: --sandbox none --seccomp none If an attacker has root-equivalent execution inside the Kata guest VM, they can send raw FUSE reques...
Astra Linux – Vulnerability in libseccomp
In versions of libsseccomp before 2.4.0, 64-bit syscall argument comparisons using arithmetic operators LT, GT, LE, GE were not generated correctly. This issue could potentially allow bypassing seccomp filters and leading to potential privilege escalations...
Astra Linux – Vulnerability in Linux 5.10, Linux
The Linux kernel before version 5.17.2 mishandles seccomp permissions. The PTRACESEIZE code path allows attackers to bypass the intended restrictions on setting the PTSUSPENDSECCOMP flag...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: seccomp: Move copyseccomp to the no-failure path. Our syzbot instance reported memory leaks in doseccomp, similar to the reports 1. This indicates that we are failing to properly free the struct seccompfilter and some objects...
Copy.Fail Linux Vulnerability
This is the worst Linux vulnerability in years. TL;DR copy.fail is a Linux kernel local privilege escalation, not a browser or clipboard attack. Disclosed by Theori on 29 April 2026 with a working PoC. It abuses the kernel crypto API AFALG sockets plus splice to write four bytes at a time straigh...