CVE-2016-3697.json

{
  "schema_version": "1.6.3",
  "id": "CVE-2016-3697",
  "modified": "2024-05-20T16:03:47Z",
  "published": "2021-04-14T20:04:52Z",
  "aliases": [
    "GO-2021-0070",
    "GHSA-q3j5-32m5-58c2"
  ],
  "related": [],
  "summary": "Privilege escalation in github.com/opencontainers/runc. libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container. libcontainer/user/user.go en runC en versiones anteriores a 0.1.0, tal como se utiliza en Docker en versiones anteriores a 1.11.2, trata indebidamente un UID numérico como un nombre de usuario potencial, lo que permite a usuarios locales obtener privilegios a través de un nombre de usuario numérico en el archivo password en un contenedor. CWE-264",
  "details": "GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will improperly interpret numeric UIDs as usernames. If the method is used without verifying that usernames are formatted as expected, it may allow a user to gain unexpected privileges. libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container",
  "severity": [
    {
      "type": "CVSS_V2",
      "score": "2.1"
    },
    {
      "type": "CVSS_V3",
      "score": "7.8"
    }
  ],
  "affected": [
    {
      "package": {
        "name": "opencontainers/runc",
        "purl": "https://github.com/opencontainers/runc"
      },
      "severity": [],
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "last_affected": "1.11.1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/opencontainers/runc/pull/708"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencontainers/runc/commit/69af385de62ea68e2e608335cffbb0f4aa3db091"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docker/docker/issues/21436"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-1034.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2634.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201612-28"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2016-05/msg00111.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencontainers/runc/releases/tag/v0.1.0"
    }
  ],
  "credits": [
    {
      "name": "Aleksa Sarai",
      "type": "REMEDIATION_DEVELOPER"
    }
  ],
  "database_specific": {
    "metrics": {
      "cvssMetricV31": [
        {
          "source": "nvd@nist.gov",
          "type": "Primary",
          "cvssData": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "attackVector": "LOCAL",
            "attackComplexity": "LOW",
            "privilegesRequired": "LOW",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9
        }
      ],
      "cvssMetricV2": [
        {
          "source": "nvd@nist.gov",
          "type": "Primary",
          "cvssData": {
            "version": "2.0",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
            "accessVector": "LOCAL",
            "accessComplexity": "LOW",
            "authentication": "NONE",
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1
          },
          "baseSeverity": "LOW",
          "exploitabilityScore": 3.9,
          "impactScore": 2.9,
          "acInsufInfo": false,
          "obtainAllPrivilege": false,
          "obtainUserPrivilege": false,
          "obtainOtherPrivilege": false,
          "userInteractionRequired": false
        }
      ]
    },
    "cwe_details": [
      {
        "cwe_id": "CWE-264",
        "name": "Primary",
        "description": "",
        "source": "nvd@nist.gov",
        "url": ""
      }
    ],
    "repositories": [
      {
        "url": "https://github.com/opencontainers/runc",
        "name": "opencontainers/runc",
        "description": "CLI tool for spawning and running containers according to the OCI specification",
        "date_created": "2015-06-05 23:30:45",
        "date_last_push": "2022-08-26 16:51:31",
        "owner": "opencontainers",
        "forks_count": "1798.0",
        "stars_count": "9515.0",
        "repo_language": "Go"
      }
    ],
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F8698BF1-AB4E-4AF8-89DE-A398CBD11176",
            "versionEndIncluding": "1.11.1"
          }
        ]
      },
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "B7483C33-6AB0-4C35-BCAF-A80193AB8723",
            "versionEndIncluding": "0.0.9"
          }
        ]
      },
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
            "matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081"
          }
        ]
      }
    ],
    "vulndb_data": {
      "url": "https://pkg.go.dev/vuln/GO-2021-0070",
      "review_status": "REVIEWED"
    },
    "datasources": {
      "govuln": true,
      "nvd": true,
      "cvefixes": true
    }
  }
}