CVE-2017-18367: Improper Input Validation in libseccomp-golang
Summary
CVE-2017-18367: Improper Input Validation in libseccomp-golang. Affects github.com/seccomp/libseccomp-golang versions < 0.9.1. Fixed in 0.9.1. How to fix ↓
Also tracked for
- golang-github-seccomp-libseccomp-golang · Debian:11
The same CVE-2017-18367 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The libseccomp-golang package is a Go language binding for libseccomp, a library that provides a simple and efficient way to filter system calls. It allows developers to define fine-grained access restrictions on system calls for a process. By specifying a restrictive seccomp filter, developers can limit the capabilities of a process and enhance its security. However, versions 0.9.0 and earlier of libseccomp-golang contain a vulnerability that allows a process to bypass intended access restrictions by specifying a single matching argument, instead of multiple arguments as intended.
Vulnerability Detail
The vulnerability in libseccomp-golang arises from the incorrect generation of Berkeley Packet Filters (BPFs) that OR multiple arguments instead of ANDing them. This flaw can be exploited by a process running under a restrictive seccomp filter that specifies multiple syscall arguments. By providing a single matching argument, the process can bypass the intended access restrictions and gain unauthorized access to system resources. The impact of this vulnerability can be significant, as it undermines the effectiveness of seccomp filters in enforcing access controls.
How To Fix
Latest published version: v0.12.0 as of 23 Oct 2026
go get github.com/seccomp/libseccomp-golang@v0.12.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.1
This is the first release that contains the fix.
go get github.com/seccomp/libseccomp-golang@v0.9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of libseccomp-golang as soon as possible.
Conclusion
The vulnerability in libseccomp-golang versions 0.9.0 and earlier allows processes to bypass access restrictions and gain unauthorized access to system resources. To mitigate this issue, users should upgrade to version 0.9.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/seccomp/libseccomp-golang →
FAQ
libseccomp-golang is a Go language binding for libseccomp, a library that provides a way to filter system calls and enforce access restrictions on processes.
The vulnerability allows a process to bypass intended access restrictions and gain unauthorized access to system resources, undermining the effectiveness of seccomp filters.
To fix this vulnerability, upgrade to version 0.9.1 or later of libseccomp-golang.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is recommended.
For more information, you can refer to the GitHub advisory at [link].
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
