{"id":"CVE-2017-18367","aliases":["DEBIAN-CVE-2017-18367","DLA-2320-1","EUVD-2021-0954","GHSA-58v3-j75h-xr49","GO-2020-0007","RHSA-2019:4087","RHSA-2020:2479","UBUNTU-CVE-2017-18367","USN-4574-1"],"status":"published","title":"Improper Input Validation in libseccomp-golang","description":"libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.0243,"percentile":0.84339,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-284"],"published":"2019-04-24T20:02:19Z","modified":"2026-10-20T10:49:29Z","fixes":[{"ecosystem":"Go","package":"github.com/seccomp/libseccomp-golang","fixed_in":["0.9.1","0.9.1-0.20170424173420-06e7a29f36a3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"golang-github-seccomp-libseccomp-golang","fixed_in":["0.9.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-github-seccomp-libseccomp-golang","fixed_in":["0.9.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-seccomp-libseccomp-golang","fixed_in":["0.9.0-2"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"golang-github-seccomp-libseccomp-golang","fixed_in":["0.0~git20150813.0.1b506fc-2+deb9u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"golang-github-seccomp-libseccomp-golang","fixed_in":["0.0~git20150813.0.1b506fc-2+deb9u1build0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/seccomp/libseccomp-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-seccomp-libseccomp-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-seccomp-libseccomp-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-seccomp-libseccomp-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"golang-github-seccomp-libseccomp-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0~git20150813.0.1b506fc-2+deb9u1"}]}],"versions":["0.0~git20150813.0.1b506fc-2"]},{"source":"osv","ecosystem":"Go","package":"github.com/seccomp/libseccomp-golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/seccomp/libseccomp-golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.1-0.20170424173420-06e7a29f36a3"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el8_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el8_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el8_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el8_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.232-1.git.0.a5bc32f.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.232-1.git.0.a5bc32f.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.232-1.git.0.a5bc32f.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-docker-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.232-1.git.0.a5bc32f.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.232-1.git.0.a5bc32f.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.232-1.git.0.a5bc32f.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hypershift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.232-1.git.0.a5bc32f.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.232-1.git.0.a5bc32f.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.232-1.git.0.a5bc32f.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.232-1.git.0.a5bc32f.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.232-1.git.0.a5bc32f.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-template-service-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.232-1.git.0.a5bc32f.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.232-1.git.0.a5bc32f.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-github-seccomp-libseccomp-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0~git20150813.0.1b506fc-2+deb9u1build0.16.04.1"}]}],"versions":["0.0~git20150813.0.1b506fc-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-github-seccomp-libseccomp-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-github-seccomp-libseccomp-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0~git20150813.0.1b506fc-2+deb9u1build0.16.04.1"}]}],"versions":["0.0~git20150813.0.1b506fc-1"]}],"products":[{"vendor":"libseccomp-golang_project","product":"libseccomp-golang"}],"references":[{"url":"https://github.com/seccomp/libseccomp-golang/issues/22","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/seccomp/libseccomp-golang/commit/06e7a29f36a34b8cf419aeb87b979ee508e58f9e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2019/04/25/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4087","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4090","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00016.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4574-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18367","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-58v3-j75h-xr49"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-18367","tags":["advisory"]},{"url":"https://usn.ubuntu.com/4574-1","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1706826","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1740434","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4087.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18367","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18367","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11250","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11250","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11250","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2479","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819486","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1821583","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2479.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11254","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11254","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8555","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8555","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8555","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2017-18367","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4574-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-18367","description":"libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.","status":"published","published":"2019-04-24T20:02:19Z","modified":"2024-08-05T21:20:50.557Z","updated_at":"2026-11-02T14:33:22.064284Z"}],"euvd":[{"id":"EUVD-2021-0954","description":"libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.","status":"published","published":"2019-04-24T20:02:19Z","modified":"2024-08-05T21:20:50Z","updated_at":"2026-11-03T02:23:07.063551Z"}],"ghsa":[{"id":"GHSA-58v3-j75h-xr49","title":"Improper Input Validation in libseccomp-golang","description":"libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.","status":"published","published":"2021-05-18T15:44:30Z","modified":"2023-01-09T05:04:42Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:36:10.502376Z"}],"nvd":[{"id":"CVE-2017-18367","description":"libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.","status":"published","published":"2019-04-24T21:29:00.243Z","modified":"2026-06-17T01:12:41.893Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:19.545286Z"}],"osv":[{"id":"CVE-2017-18367","description":"libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.","status":"published","published":"2019-04-24T21:29:00.243Z","modified":"2026-10-20T10:49:29.818381664Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-18367","description":"libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.","status":"published","published":"2019-04-24T21:29:00.243Z","modified":"2026-09-01T20:03:47.613593412Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"GHSA-58v3-j75h-xr49","title":"Improper Input Validation in libseccomp-golang","description":"libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.","status":"published","published":"2021-05-18T15:44:30Z","modified":"2023-11-08T03:59:16.160893Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"RHSA-2019:4087","title":"Red Hat Security Advisory: OpenShift Container Platform 4.1 openshift security update","status":"published","published":"2024-09-16T03:22:16Z","modified":"2026-03-23T04:47:28.697675Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:2479","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update","status":"published","published":"2024-09-18T04:13:37Z","modified":"2026-08-05T10:07:15Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2017-18367","description":"libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.","status":"published","published":"2019-04-24T21:29:00Z","modified":"2026-02-04T03:05:05.494989Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"DLA-2320-1","title":"golang-github-seccomp-libseccomp-golang - security update","status":"published","published":"2020-08-10T00:00:00Z","modified":"2026-03-09T01:21:02.774571Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"GO-2020-0007","title":"Improper input validation in github.com/seccomp/libseccomp-golang","description":"Filters containing rules with multiple syscall arguments are improperly constructed, such that all arguments are required to match rather than any of the arguments (AND is used rather than OR). These filters can be bypassed by only specifying a subset of the arguments due to this behavior.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"USN-4574-1","title":"golang-github-seccomp-libseccomp-golang vulnerability","description":"It was discovered that libseccomp-golang did not properly generate BPFs. If\na process were running under a restrictive seccomp filter that specified\nmultiple syscall arguments, the application could potentially bypass the\nintended restrictions put in place by seccomp.\n","status":"published","published":"2020-10-07T19:32:20Z","modified":"2026-04-27T15:43:31.84623Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}