CVE-2017-18367
Improper Input Validation in libseccomp-golang
libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.
- Record
CVE-2017-18367- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.
- Record
CVE-2017-18367- Updated
- 2026-11-02
EUVDEUVD-2021-0954 No score
libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.
- Record
EUVD-2021-0954- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-58v3-j75h-xr49
Improper Input Validation in libseccomp-golang
libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.
- Record
GHSA-58v3-j75h-xr49- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.
- Record
CVE-2017-18367- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-18367
libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.
- Record
DEBIAN-CVE-2017-18367- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-58v3-j75h-xr49
Improper Input Validation in libseccomp-golang
libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.
- Record
GHSA-58v3-j75h-xr49- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVRHSA-2019:4087
Red Hat Security Advisory: OpenShift Container Platform 4.1 openshift security update
- Record
RHSA-2019:4087- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2020:2479
Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update
- Record
RHSA-2020:2479- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-18367
libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.
- Record
UBUNTU-CVE-2017-18367- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGO-2020-0007 No score
Improper input validation in github.com/seccomp/libseccomp-golang
Filters containing rules with multiple syscall arguments are improperly constructed, such that all arguments are required to match rather than any of the arguments (AND is used rather than OR). These filters can be bypassed by only specifying a subset of the arguments due to this behavior.
- Record
GO-2020-0007- Updated
- 2026-11-02
OSVUSN-4574-1 No score
golang-github-seccomp-libseccomp-golang vulnerability
It was discovered that libseccomp-golang did not properly generate BPFs. If a process were running under a restrictive seccomp filter that specified multiple syscall arguments, the application could potentially bypass the intended restrictions put in place by seccomp.
- Record
USN-4574-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/seccomp/libseccomp-golangGo |
before 0.9.1 | 0.9.1 |
golang-github-seccomp-libseccomp-golangDebian:12 |
before 0.9.0-2 | 0.9.0-2 |
golang-github-seccomp-libseccomp-golangDebian:13 |
before 0.9.0-2 | 0.9.0-2 |
golang-github-seccomp-libseccomp-golangDebian:14 |
before 0.9.0-2 | 0.9.0-2 |
golang-github-seccomp-libseccomp-golangDebian:9 |
before 0.0~git20150813.0.1b506fc-2+deb9u1, plus listed versions 0.0~git20150813.0.1b506fc-2 |
0.0~git20150813.0.1b506fc-2+deb9u1 |
github.com/seccomp/libseccomp-golangGo |
before 0.9.1-0.20170424173420-06e7a29f36a3 | 0.9.1-0.20170424173420-06e7a29f36a3 |
openshiftRed Hat:openshift:4.1::el7 |
before 0:4.1.27-201912021146.git.0.a40116f.el7 | 0:4.1.27-201912021146.git.0.a40116f.el7 |
openshift-clientsRed Hat:openshift:4.1::el7 |
before 0:4.1.27-201912021146.git.0.a40116f.el7 | 0:4.1.27-201912021146.git.0.a40116f.el7 |
openshift-clients-redistributableRed Hat:openshift:4.1::el7 |
before 0:4.1.27-201912021146.git.0.a40116f.el7 | 0:4.1.27-201912021146.git.0.a40116f.el7 |
openshift-hyperkubeRed Hat:openshift:4.1::el7 |
before 0:4.1.27-201912021146.git.0.a40116f.el7 | 0:4.1.27-201912021146.git.0.a40116f.el7 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openshiftRed Hat:openshift:4.1::el8 |
before 0:4.1.27-201912021146.git.0.a40116f.el8_0 | 0:4.1.27-201912021146.git.0.a40116f.el8_0 |
openshift-clientsRed Hat:openshift:4.1::el8 |
before 0:4.1.27-201912021146.git.0.a40116f.el8_0 | 0:4.1.27-201912021146.git.0.a40116f.el8_0 |
openshift-clients-redistributableRed Hat:openshift:4.1::el8 |
before 0:4.1.27-201912021146.git.0.a40116f.el8_0 | 0:4.1.27-201912021146.git.0.a40116f.el8_0 |
openshift-hyperkubeRed Hat:openshift:4.1::el8 |
before 0:4.1.27-201912021146.git.0.a40116f.el8_0 | 0:4.1.27-201912021146.git.0.a40116f.el8_0 |
atomic-openshiftRed Hat:openshift:3.11::el7 |
before 0:3.11.232-1.git.0.a5bc32f.el7 | 0:3.11.232-1.git.0.a5bc32f.el7 |
atomic-openshift-clientsRed Hat:openshift:3.11::el7 |
before 0:3.11.232-1.git.0.a5bc32f.el7 | 0:3.11.232-1.git.0.a5bc32f.el7 |
atomic-openshift-clients-redistributableRed Hat:openshift:3.11::el7 |
before 0:3.11.232-1.git.0.a5bc32f.el7 | 0:3.11.232-1.git.0.a5bc32f.el7 |
atomic-openshift-docker-excluderRed Hat:openshift:3.11::el7 |
before 0:3.11.232-1.git.0.a5bc32f.el7 | 0:3.11.232-1.git.0.a5bc32f.el7 |
atomic-openshift-excluderRed Hat:openshift:3.11::el7 |
before 0:3.11.232-1.git.0.a5bc32f.el7 | 0:3.11.232-1.git.0.a5bc32f.el7 |
atomic-openshift-hyperkubeRed Hat:openshift:3.11::el7 |
before 0:3.11.232-1.git.0.a5bc32f.el7 | 0:3.11.232-1.git.0.a5bc32f.el7 |
atomic-openshift-hypershiftRed Hat:openshift:3.11::el7 |
before 0:3.11.232-1.git.0.a5bc32f.el7 | 0:3.11.232-1.git.0.a5bc32f.el7 |
atomic-openshift-masterRed Hat:openshift:3.11::el7 |
before 0:3.11.232-1.git.0.a5bc32f.el7 | 0:3.11.232-1.git.0.a5bc32f.el7 |
atomic-openshift-nodeRed Hat:openshift:3.11::el7 |
before 0:3.11.232-1.git.0.a5bc32f.el7 | 0:3.11.232-1.git.0.a5bc32f.el7 |
atomic-openshift-podRed Hat:openshift:3.11::el7 |
before 0:3.11.232-1.git.0.a5bc32f.el7 | 0:3.11.232-1.git.0.a5bc32f.el7 |
atomic-openshift-sdn-ovsRed Hat:openshift:3.11::el7 |
before 0:3.11.232-1.git.0.a5bc32f.el7 | 0:3.11.232-1.git.0.a5bc32f.el7 |
atomic-openshift-template-service-brokerRed Hat:openshift:3.11::el7 |
before 0:3.11.232-1.git.0.a5bc32f.el7 | 0:3.11.232-1.git.0.a5bc32f.el7 |
atomic-openshift-testsRed Hat:openshift:3.11::el7 |
before 0:3.11.232-1.git.0.a5bc32f.el7 | 0:3.11.232-1.git.0.a5bc32f.el7 |
golang-github-seccomp-libseccomp-golangUbuntu:16.04:LTS |
before 0.0~git20150813.0.1b506fc-2+deb9u1build0.16.04.1, plus listed versions 0.0~git20150813.0.1b506fc-1 |
0.0~git20150813.0.1b506fc-2+deb9u1build0.16.04.1 |
golang-github-seccomp-libseccomp-golangUbuntu:18.04:LTS |
All versions, plus listed versions 0.9.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-18367 is a high vulnerability (CVSS 7.5) in Libseccomp-golang Project Libseccomp-golang, published April 24, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.43%, the 84th percentile. Fixed in github.com/seccomp/libseccomp-golang 0.9.1.
References
github.com/seccomp/libseccomp-golang/issues/22
openwall.com/lists/oss-security/2019/04/25/6
access.redhat.com/errata/RHSA-2019:4087
lists.debian.org/debian-lts-announce/2020/08/msg00016.html
Show 26 moreShow less
usn.ubuntu.com/4574-1
nvd.nist.gov/vuln/detail/CVE-2017-18367
security-tracker.debian.org/tracker/CVE-2017-18367
bugzilla.redhat.com/show_bug.cgi?id=1706826
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4087.json
cve.org/CVERecord?id=CVE-2017-18367
groups.google.com/forum
ubuntu.com/security/CVE-2017-18367