CVE-2016-9962: Information Exposure in RunC
Summary
CVE-2016-9962: Information Exposure in RunC. Affects github.com/opencontainers/runc versions < 1.0.0-rc3. Fixed in 1.0.0-rc3. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2016-9962 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
RunC is an open-source command-line tool for spawning and running containers according to the Open Container Initiative (OCI) specification. It is written in Go and is widely used in container runtime environments. RunC allows users to create and manage containers, providing a secure and isolated environment for running applications. However, a vulnerability has been discovered in RunC that allows additional container processes to be traced by the main process of the container, potentially leading to container escapes or modification of RunC state.
Vulnerability Detail
The vulnerability (CVE-2016-9962) in RunC arises from the 'runc exec' command, which allows the execution of additional processes within a container. When these new processes are executed, the main process of the container, if running as root, can gain access to their file descriptors during initialization. This can be exploited to escape the container's isolation and access sensitive information or modify the state of RunC before the process is fully placed inside the container. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.4.
How To Fix
Latest published version: v1.5.2 as of 22 Oct 2026
go get github.com/opencontainers/runc@v1.5.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0-rc3
This is the first release that contains the fix.
go get github.com/opencontainers/runc@v1.0.0-rc3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating RunC is not immediately feasible, a possible workaround is to avoid running containers as root. By running containers with non-root privileges, the main process will not have the necessary permissions to ptrace additional processes and exploit the vulnerability. However, this workaround may not be applicable in all scenarios and updating to the latest version of RunC is still recommended.
Conclusion
The vulnerability in RunC (CVE-2016-9962) allows the main process of a container to gain unauthorized access to file descriptors of additional container processes, potentially leading to container escapes or modification of RunC state. To mitigate this vulnerability, it is crucial to update RunC to version 1.0.0-rc3 or later. Alternatively, running containers with non-root privileges can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/opencontainers/runc →
FAQ
RunC is an open-source command-line tool for spawning and running containers according to the Open Container Initiative (OCI) specification. It provides a secure and isolated environment for running applications.
The vulnerability in RunC allows the main process of a container, if running as root, to gain access to file descriptors of additional container processes. This can lead to container escapes or modification of RunC state, potentially compromising the security and integrity of the container runtime environment.
To fix this vulnerability, it is recommended to update RunC to version 1.0.0-rc3 or later. This version includes the necessary patches to prevent the main process of a container from ptracing additional container processes.
If updating RunC is not immediately feasible, a possible workaround is to avoid running containers as root. By running containers with non-root privileges, the main process will not have the necessary permissions to ptrace additional processes and exploit the vulnerability. However, updating to the latest version of RunC is still recommended.
Yes, the CVSS score for this vulnerability is 6.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/opencontainers/runc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
