libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has docker-ce packages installed that are affected by multiple vulnerabilities:

  - Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0,     17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a     Denial of Service via a crafted image layer payload, aka gzip bombing. (CVE-2017-14992)

  - The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block     /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are     used) by leveraging Docker container access to write a scsi remove-single-device line to     /proc/scsi/scsi, aka SCSI MICDROP. (CVE-2017-16539)

  - libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than     ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall     arguments could bypass intended access restrictions by specifying a single matching argument.
    (CVE-2017-18367)

  - The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block     /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling     bluetooth or turning up/down keyboard brightness. (CVE-2018-10892)

  - In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a     symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host     filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen     filesystem (or from within a chroot). (CVE-2018-15664)

  - Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via     a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go,     pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go. (CVE-2018-20699)

  - In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the     docker build command would be able to gain command execution. An issue exists in the way docker build     processes remote git URLs, and results in command injection into the underlying git clone command,     leading to code execution in the context of the user executing the docker build command. This occurs     because git ref can be misinterpreted as a flag. (CVE-2019-13139)

  - In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before     18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a     scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It     potentially applies to other API users of the stack API if they resend the secret. (CVE-2019-13509)

  - runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
    (CVE-2019-5736)

  - An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW     capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain     sensitive information, or cause a denial of service. (CVE-2020-13401)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has docker-ce packages installed that are affected by multiple vulnerabilities:

  - Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0,     17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a     Denial of Service via a crafted image layer payload, aka gzip bombing. (CVE-2017-14992)

  - The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block     /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are     used) by leveraging Docker container access to write a scsi remove-single-device line to     /proc/scsi/scsi, aka SCSI MICDROP. (CVE-2017-16539)

  - libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than     ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall     arguments could bypass intended access restrictions by specifying a single matching argument.
    (CVE-2017-18367)

  - The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block     /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling     bluetooth or turning up/down keyboard brightness. (CVE-2018-10892)

  - In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a     symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host     filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen     filesystem (or from within a chroot). (CVE-2018-15664)

  - Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via     a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go,     pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go. (CVE-2018-20699)

  - In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the     docker build command would be able to gain command execution. An issue exists in the way docker build     processes remote git URLs, and results in command injection into the underlying git clone command,     leading to code execution in the context of the user executing the docker build command. This occurs     because git ref can be misinterpreted as a flag. (CVE-2019-13139)

  - In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before     18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a     scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It     potentially applies to other API users of the stack API if they resend the secret. (CVE-2019-13509)

  - runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
    (CVE-2019-5736)

  - An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW     capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain     sensitive information, or cause a denial of service. (CVE-2020-13401)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4574-1 advisory.

  - libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than     ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall     arguments could bypass intended access restrictions by specifying a single matching argument.
    (CVE-2017-18367)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.

Additionally, runc has been rebuilt with the fixed package.

For Debian 9 stretch, this problem has been fixed in version 0.0~git20150813.0.1b506fc-2+deb9u1.

We recommend that you upgrade your golang-github-seccomp-libseccomp-golang and runc packages, and recompile own Go code using golang-github-seccomp-libseccomp-golang.

For the detailed security status of golang-github-seccomp-libseccomp-golang please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/golang-github-seccomp-libs eccomp-golang

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2479 advisory.

  - libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access     restrictions (CVE-2017-18367)

  - kubernetes: Denial of service in API server via crafted YAML payloads by authorized users (CVE-2019-11254)

  - kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret     information (CVE-2020-8555)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4087 advisory.

  - libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access     restrictions (CVE-2017-18367)

  - kubernetes: Bearer tokens written to logs at high verbosity levels (>= 7) (CVE-2019-11250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
154519	NewStart CGSL CORE 5.05 / MAIN 5.05 : docker-ce Multiple Vulnerabilities (NS-SA-2021-0138)	Nessus	NewStart CGSL Local Security Checks	high
143962	NewStart CGSL CORE 5.04 / MAIN 5.04 : docker-ce Multiple Vulnerabilities (NS-SA-2020-0082)	Nessus	NewStart CGSL Local Security Checks	high
141302	Ubuntu 16.04 LTS : libseccomp-golang vulnerability (USN-4574-1)	Nessus	Ubuntu Local Security Checks	high
139518	Debian DLA-2320-1 : golang-github-seccomp-libseccomp-golang security update	Nessus	Debian Local Security Checks	high
137668	RHEL 7 : OpenShift Container Platform 3.11 atomic-openshift (RHSA-2020:2479)	Nessus	Red Hat Local Security Checks	high
132225	RHEL 7 / 8 : OpenShift Container Platform 4.1 openshift (RHSA-2019:4087)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2017-18367

high

Tenable Plugins

high

high

high

high

high

high