CVE-2017-18367

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2019/04/25/6Mailing List, Patch, Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4087
https://access.redhat.com/errata/RHSA-2019:4090
https://github.com/seccomp/libseccomp-golang/commit/06e7a29f36a34b8cf419aeb87b979ee508e58f9ePatch, Third Party Advisory
https://github.com/seccomp/libseccomp-golang/issues/22Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00016.html
https://usn.ubuntu.com/4574-1/
http://www.openwall.com/lists/oss-security/2019/04/25/6Mailing List, Patch, Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4087
https://access.redhat.com/errata/RHSA-2019:4090
https://github.com/seccomp/libseccomp-golang/commit/06e7a29f36a34b8cf419aeb87b979ee508e58f9ePatch, Third Party Advisory
https://github.com/seccomp/libseccomp-golang/issues/22Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00016.html
https://usn.ubuntu.com/4574-1/

Timeline

Published: Apr 24, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-183689.8The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in CVE-2017-183699.8The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwardin CVE-2017-183708.8The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log CVE-2017-183719.8The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two CVE-2017-183728.8The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setti CVE-2017-183738.8The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has three user accounts with default passwords, includi CVE-2017-183748.8The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has two user accounts with default passw CVE-2017-183758.8Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php.CVE-2017-183768.8An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before 3.3.1 allows users with read-only or read/write acce CVE-2017-183779.8An issue was discovered on Wireless IP Camera (P2P) WIFICAM cameras. There is Command Injection in the set_ftp.cgi script via shell metachar CVE-2017-183789.8In NETGEAR ReadyNAS Surveillance before 1.4.3-17 x86 and before 1.1.4-7 ARM, $_GET['uploaddir'] is not escaped and is passed to system() thr CVE-2017-183799.8In the Linux kernel before 4.14, an out of boundary access happened in drivers/nvme/target/fc.c.