Privilege Escalation Vulnerability in runc: Numeric UID Misinterpretation
Summary
CVE-2016-3697: libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password... Affects runc across 4 version ranges.
< 0.1.0+dfsg-1
< 8e129e097220b2591edd59957c4ff08e064e14b9
< 69af385de62ea68e2e608335cffbb0f4aa3db091
< 5604cbed50d51c4039b1abcb1cf87c4e01bce924
Fixed in 0.1.0+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
runc is a lightweight container runtime that is used to create and manage containers in various environments, including Docker. It is designed to be simple and efficient, allowing users to run containers based on the Open Container Initiative (OCI) specifications. However, prior to version 0.1.0, runc had a vulnerability that allowed local users to exploit the way numeric UIDs were treated, potentially leading to privilege escalation within containers.
Vulnerability Detail
The vulnerability, identified as CVE-2016-3697, arises from the improper handling of numeric UIDs as potential usernames in the libcontainer/user/user.go file of runc before version 0.1.0. This flaw allows local users to gain elevated privileges by using a numeric username in the password file within a container. The ramifications of this vulnerability are significant, as it can lead to unauthorized access and control over containerized applications, compromising the security of the host system.
How To Fix
Minimum fixed version
0.1.0+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade runcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using numeric usernames in the password file within containers until the upgrade is applied. Additionally, restricting access to the container environment can help mitigate the risk of exploitation.
Conclusion
CVE-2016-3697 represents a significant security risk for users of runc prior to version 0.1.0. By understanding the nature of this vulnerability and taking appropriate action to upgrade or implement workarounds, users can protect their containerized applications from potential exploitation.
See every vulnerability recorded for runc →
FAQ
CVE-2016-3697 is a vulnerability in runc that allows local users to escalate privileges by exploiting the improper handling of numeric UIDs as usernames.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2016-3697 is 7.8, indicating a high severity level.
If exploited, this vulnerability can allow unauthorized users to gain elevated privileges within containers, potentially compromising the host system's security.
If an immediate upgrade is not possible, consider implementing access restrictions to the container environment and avoid using numeric usernames in the password file.
Related vulnerabilities
Recent vulnerabilities recorded for runc.
