CVE-2017-18367: Improper Input Validation in libseccomp-golang
Summary
CVE-2017-18367: Improper input validation in github.com/seccomp/libseccomp-golang. Affects github.com/seccomp/libseccomp-golang versions < 0.9.1-0.20170424173420-06e7a29f36a3. Fixed in 0.9.1-0.20170424173420-06e7a29f36a3. How to fix ↓
Also tracked for
- golang-github-seccomp-libseccomp-golang · Debian:11
The same CVE-2017-18367 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libseccomp-golang is a Go library that provides a high-level interface to the Linux kernel's seccomp functionality. Seccomp is a mechanism that allows fine-grained control over the system calls that a process can make. It is commonly used to restrict the capabilities of a process and mitigate the impact of potential vulnerabilities. However, versions 0.9.0 and earlier of libseccomp-golang have a vulnerability that allows a process to bypass intended access restrictions under certain conditions.
Vulnerability Detail
The vulnerability in libseccomp-golang arises from an improper input validation issue. When generating Berkeley Packet Filters (BPFs) for seccomp filters, the library incorrectly ORs multiple syscall arguments instead of ANDing them. This means that a process running under a restrictive seccomp filter that specifies multiple syscall arguments can bypass the intended access restrictions by specifying a single matching argument. This can lead to unauthorized access or privilege escalation, depending on the specific seccomp filter in place.
How To Fix
Latest published version: v0.12.0 as of 23 Oct 2026
go get github.com/seccomp/libseccomp-golang@v0.12.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.1-0.20170424173420-06e7a29f36a3
This is the first release that contains the fix.
go get github.com/seccomp/libseccomp-golang@v0.9.1-0.20170424173420-06e7a29f36a3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to the fixed version of libseccomp-golang to address the issue.
Conclusion
The vulnerability in libseccomp-golang can be mitigated by upgrading to version 0.9.1 or later. It is important to promptly update the library to ensure that syscall arguments are correctly validated and access restrictions are enforced. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/seccomp/libseccomp-golang →
FAQ
libseccomp-golang is a Go library that provides a high-level interface to the Linux kernel's seccomp functionality. It allows developers to apply fine-grained control over the system calls that a process can make.
Seccomp is a Linux kernel feature that enables the restriction of system call usage for a process. It can be used to reduce the attack surface and mitigate the impact of potential vulnerabilities.
Versions 0.9.0 and earlier of libseccomp-golang are affected by this vulnerability.
The vulnerability allows a process to bypass intended access restrictions specified by a seccomp filter. This can lead to unauthorized access or privilege escalation, depending on the specific seccomp filter in place.
No, there is no known workaround for this vulnerability. It is necessary to upgrade to the fixed version of libseccomp-golang.
