CVE-2016-3697 : libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2,

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.

Published 2016-06-01 20:59:06

Updated 2021-01-05 17:38:41

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2016-3697

Opensuse » Opensuse » Version: 13.2
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
Matching versions
Linuxfoundation » Runc
Versions up to, including, (<=) 0.0.9
cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*
Matching versions
Docker » Docker
Versions up to, including, (<=) 1.11.1
cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-3697

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-3697

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2016-3697

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-3697

https://security.gentoo.org/glsa/201612-28

Docker: Privilege escalation (GLSA 201612-28) — Gentoo security
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1034.html

RHSA-2016:1034 - Security Advisory - Red Hat Customer Portal
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2634.html

RHSA-2016:2634 - Security Advisory - Red Hat Customer Portal
Third Party Advisory
https://github.com/opencontainers/runc/releases/tag/v0.1.0

Release Runc v0.1.0 · opencontainers/runc · GitHub
Patch;Third Party Advisory
https://github.com/docker/docker/issues/21436

Numeric user id passed to --user interpreted as user name if user name is numeric in container /etc/passwd · Issue #21436 · moby/moby · GitHub
Patch;Third Party Advisory
https://github.com/opencontainers/runc/commit/69af385de62ea68e2e608335cffbb0f4aa3db091

libcontainer: user: always treat numeric ids numerically · opencontainers/runc@69af385 · GitHub
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-05/msg00111.html

openSUSE-SU-2016:1417-1: moderate: Security update for docker
Mailing List;Third Party Advisory
https://github.com/opencontainers/runc/pull/708

libcontainer: user: always treat numeric ids numerically by cyphar · Pull Request #708 · opencontainers/runc · GitHub
Third Party Advisory

Jump to

Vulnerability Details : CVE-2016-3697

Products affected by CVE-2016-3697

Exploit prediction scoring system (EPSS) score for CVE-2016-3697

CVSS scores for CVE-2016-3697

CWE ids for CVE-2016-3697

References for CVE-2016-3697