The vulnerability of the libcontainer/user/user.go implementation, a tool for running isolated containers in Runc, allows a malicious actor to escalate their privileges.

The vulnerability of the libcontainer/user/user.go implementation, a tool for running isolated containers in Runc, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to enhance their privileges...

CVE-2016-3697

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container...

CVE-2016-3697: Undefined Security Weakness

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container...

PT-2016-5663

Name of the Vulnerable Software and Affected Versions runC versions prior to 0.1.0 Docker versions prior to 1.11.2 Description The issue improperly treats a numeric UID as a potential username, allowing local users to gain privileges via a numeric username in the password file in a container. Thi...