CVE-2017-18367: Improper input validation in github.com/seccomp/libseccomp-golang
Summary
CVE-2017-18367: Improper input validation in github.com/seccomp/libseccomp-golang. Affects github.com/seccomp/libseccomp-golang versions < 0.9.1-0.20170424173420-06e7a29f36a3. Fixed in 0.9.1-0.20170424173420-06e7a29f36a3. How to fix ↓
Also tracked for
- golang-github-seccomp-libseccomp-golang · Debian:11
The same CVE-2017-18367 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package github.com/seccomp/libseccomp-golang is a Go language binding for libseccomp, a library that provides an interface to the Linux kernel's seccomp mechanism. It allows developers to define and enforce system call filters for their applications, enhancing security by restricting the available system calls. However, a vulnerability has been identified in the package that affects the construction of filters containing rules with multiple syscall arguments.
Vulnerability Detail
The vulnerability in github.com/seccomp/libseccomp-golang arises from the improper construction of filters with rules containing multiple syscall arguments. Instead of using an OR operator to match any of the arguments, an AND operator is mistakenly used, requiring all arguments to match. This behavior allows the filters to be bypassed by specifying only a subset of the arguments. As a result, an attacker could potentially exploit this vulnerability to bypass intended restrictions and execute unauthorized system calls.
How To Fix
Latest published version: v0.12.0 as of 23 Oct 2026
go get github.com/seccomp/libseccomp-golang@v0.12.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.1-0.20170424173420-06e7a29f36a3
This is the first release that contains the fix.
go get github.com/seccomp/libseccomp-golang@v0.9.1-0.20170424173420-06e7a29f36a3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in github.com/seccomp/libseccomp-golang allows for the bypassing of system call restrictions, potentially leading to unauthorized access or execution of system calls. To mitigate this vulnerability, it is recommended to update to version 0.9.1-0.20170424173420-06e7a29f36a3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/seccomp/libseccomp-golang →
FAQ
This vulnerability allows an attacker to bypass system call restrictions enforced by the libseccomp library, potentially leading to unauthorized access or execution of system calls.
There are no known public exploits for this vulnerability at the time of this report.
No, versions prior to 0.9.1-0.20170424173420-06e7a29f36a3 are not affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
You can find more information about this vulnerability in the official vulnerability report at https://pkg.go.dev/vuln/GO-2020-0007.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
