Vulnerability-Lookup

CNVD-2017-00924

Vulnerability from cnvd - Published: 2017-02-05

Title

Docker本地权限提升漏洞（CNVD-2017-00924）

Description

Docker是美国Docker公司的一款开源的应用容器引擎，它支持在Linux系统上创建一个容器（轻量级虚拟机）并部署和运行应用程序，以及通过配置文件实现应用程序的自动化安装、部署和升级。 Docker 1.12.6之前的版本存在本地权限提升漏洞。本地攻击者可利用此漏洞获取提升的权限。

Severity

高

Patch Name

Docker本地权限提升漏洞（CNVD-2017-00924）的补丁

Patch Description

Docker是美国Docker公司的一款开源的应用容器引擎，它支持在Linux系统上创建一个容器（轻量级虚拟机）并部署和运行应用程序，以及通过配置文件实现应用程序的自动化安装、部署和升级。 Docker 1.12.6之前的版本存在本地权限提升漏洞。本地攻击者可利用此漏洞获取提升的权限。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可联系供应商获得补丁信息： https://www.docker.com/

Reference

http://www.securityfocus.com/bid/95361

Impacted products

Name
Docker Docker <1.12.6

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "95361"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-9962",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9962"
    }
  },
  "description": "Docker\u662f\u7f8e\u56fdDocker\u516c\u53f8\u7684\u4e00\u6b3e\u5f00\u6e90\u7684\u5e94\u7528\u5bb9\u5668\u5f15\u64ce\uff0c\u5b83\u652f\u6301\u5728Linux\u7cfb\u7edf\u4e0a\u521b\u5efa\u4e00\u4e2a\u5bb9\u5668\uff08\u8f7b\u91cf\u7ea7\u865a\u62df\u673a\uff09\u5e76\u90e8\u7f72\u548c\u8fd0\u884c\u5e94\u7528\u7a0b\u5e8f\uff0c\u4ee5\u53ca\u901a\u8fc7\u914d\u7f6e\u6587\u4ef6\u5b9e\u73b0\u5e94\u7528\u7a0b\u5e8f\u7684\u81ea\u52a8\u5316\u5b89\u88c5\u3001\u90e8\u7f72\u548c\u5347\u7ea7\u3002\r\n\r\nDocker 1.12.6\u4e4b\u524d\u7684\u7248\u672c\u5b58\u5728\u672c\u5730\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u83b7\u53d6\u63d0\u5347\u7684\u6743\u9650\u3002",
  "discovererName": "Aleksa Sarai from SUSE and T\u0026otilde;nis Tiigi from Docker.",
  "formalWay": "\u7528\u6237\u53ef\u8054\u7cfb\u4f9b\u5e94\u5546\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://www.docker.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-00924",
  "openTime": "2017-02-05",
  "patchDescription": "Docker\u662f\u7f8e\u56fdDocker\u516c\u53f8\u7684\u4e00\u6b3e\u5f00\u6e90\u7684\u5e94\u7528\u5bb9\u5668\u5f15\u64ce\uff0c\u5b83\u652f\u6301\u5728Linux\u7cfb\u7edf\u4e0a\u521b\u5efa\u4e00\u4e2a\u5bb9\u5668\uff08\u8f7b\u91cf\u7ea7\u865a\u62df\u673a\uff09\u5e76\u90e8\u7f72\u548c\u8fd0\u884c\u5e94\u7528\u7a0b\u5e8f\uff0c\u4ee5\u53ca\u901a\u8fc7\u914d\u7f6e\u6587\u4ef6\u5b9e\u73b0\u5e94\u7528\u7a0b\u5e8f\u7684\u81ea\u52a8\u5316\u5b89\u88c5\u3001\u90e8\u7f72\u548c\u5347\u7ea7\u3002\r\n\r\nDocker 1.12.6\u4e4b\u524d\u7684\u7248\u672c\u5b58\u5728\u672c\u5730\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u83b7\u53d6\u63d0\u5347\u7684\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Docker\u672c\u5730\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2017-00924\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Docker Docker \u003c1.12.6"
  },
  "referenceLink": "http://www.securityfocus.com/bid/95361",
  "serverity": "\u9ad8",
  "submitTime": "2017-01-20",
  "title": "Docker\u672c\u5730\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2017-00924\uff09"
}

CVE-2016-9962 (GCVE-0-2016-9962)

Vulnerability from cvelistv5 – Published: 2017-01-31 22:00 – Updated: 2024-08-06 03:07

Summary

RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root Scorecard

References

16 references

URL	Tags
http://www.securityfocus.com/bid/95361	vdb-entryx_refsource_BID
https://github.com/docker/docker/releases/tag/v1.12.6	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2017-0116.html	vendor-advisoryx_refsource_REDHAT
http://seclists.org/fulldisclosure/2017/Jan/29	mailing-listx_refsource_FULLDISC
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://bugzilla.suse.com/show_bug.cgi?id=1012568#c6	x_refsource_CONFIRM
https://security.gentoo.org/glsa/201701-34	vendor-advisoryx_refsource_GENTOO
http://rhn.redhat.com/errata/RHSA-2017-0123.html	vendor-advisoryx_refsource_REDHAT
https://github.com/opencontainers/runc/commit/50a…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2017-0127.html	vendor-advisoryx_refsource_REDHAT
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://access.redhat.com/security/vulnerabilitie…	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
http://www.securityfocus.com/archive/1/540001/100…	mailing-listx_refsource_BUGTRAQ
http://seclists.org/fulldisclosure/2017/Jan/21	mailing-listx_refsource_FULLDISC

Date Public

2017-01-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T03:07:31.309Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "95361",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95361"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/docker/docker/releases/tag/v1.12.6"
          },
          {
            "name": "RHSA-2017:0116",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-0116.html"
          },
          {
            "name": "20170111 Re: [oss-security] Docker 1.12.6 - Security Advisory",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2017/Jan/29"
          },
          {
            "name": "FEDORA-2017-fcd02e2c2d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WUQ3MQNEL5IBZZLMLR72Q4YDCL2SCKRK/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1012568#c6"
          },
          {
            "name": "GLSA-201701-34",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201701-34"
          },
          {
            "name": "RHSA-2017:0123",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-0123.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3dacde268afe5"
          },
          {
            "name": "RHSA-2017:0127",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-0127.html"
          },
          {
            "name": "FEDORA-2017-c2c2d1be16",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FINGBFMIXBG6B6ZWYH3TMRP5V3PDBNXR/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/vulnerabilities/cve-2016-9962"
          },
          {
            "name": "FEDORA-2017-dbc2b618eb",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAXJMMLRU7DD2IMG47SR2K4BOFFG7FZ/"
          },
          {
            "name": "FEDORA-2017-0200646669",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVM7FCOQMPKOFLDTUYSS4ES76DDM56VP/"
          },
          {
            "name": "20170111 Re: [oss-security] Docker 1.12.6 - Security Advisory",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/540001/100/0/threaded"
          },
          {
            "name": "20170110 Docker 1.12.6 - Security Advisory",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2017/Jan/21"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-01-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RunC allowed additional container processes via \u0027runc exec\u0027 to be ptraced by the pid 1 of the container.  This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "95361",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95361"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/docker/docker/releases/tag/v1.12.6"
        },
        {
          "name": "RHSA-2017:0116",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-0116.html"
        },
        {
          "name": "20170111 Re: [oss-security] Docker 1.12.6 - Security Advisory",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2017/Jan/29"
        },
        {
          "name": "FEDORA-2017-fcd02e2c2d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WUQ3MQNEL5IBZZLMLR72Q4YDCL2SCKRK/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1012568#c6"
        },
        {
          "name": "GLSA-201701-34",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201701-34"
        },
        {
          "name": "RHSA-2017:0123",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-0123.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3dacde268afe5"
        },
        {
          "name": "RHSA-2017:0127",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-0127.html"
        },
        {
          "name": "FEDORA-2017-c2c2d1be16",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FINGBFMIXBG6B6ZWYH3TMRP5V3PDBNXR/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://access.redhat.com/security/vulnerabilities/cve-2016-9962"
        },
        {
          "name": "FEDORA-2017-dbc2b618eb",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAXJMMLRU7DD2IMG47SR2K4BOFFG7FZ/"
        },
        {
          "name": "FEDORA-2017-0200646669",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVM7FCOQMPKOFLDTUYSS4ES76DDM56VP/"
        },
        {
          "name": "20170111 Re: [oss-security] Docker 1.12.6 - Security Advisory",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/540001/100/0/threaded"
        },
        {
          "name": "20170110 Docker 1.12.6 - Security Advisory",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2017/Jan/21"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-9962",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RunC allowed additional container processes via \u0027runc exec\u0027 to be ptraced by the pid 1 of the container.  This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "95361",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/95361"
            },
            {
              "name": "https://github.com/docker/docker/releases/tag/v1.12.6",
              "refsource": "CONFIRM",
              "url": "https://github.com/docker/docker/releases/tag/v1.12.6"
            },
            {
              "name": "RHSA-2017:0116",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2017-0116.html"
            },
            {
              "name": "20170111 Re: [oss-security] Docker 1.12.6 - Security Advisory",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2017/Jan/29"
            },
            {
              "name": "FEDORA-2017-fcd02e2c2d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WUQ3MQNEL5IBZZLMLR72Q4YDCL2SCKRK/"
            },
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1012568#c6",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1012568#c6"
            },
            {
              "name": "GLSA-201701-34",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201701-34"
            },
            {
              "name": "RHSA-2017:0123",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2017-0123.html"
            },
            {
              "name": "https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3dacde268afe5",
              "refsource": "CONFIRM",
              "url": "https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3dacde268afe5"
            },
            {
              "name": "RHSA-2017:0127",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2017-0127.html"
            },
            {
              "name": "FEDORA-2017-c2c2d1be16",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FINGBFMIXBG6B6ZWYH3TMRP5V3PDBNXR/"
            },
            {
              "name": "https://access.redhat.com/security/vulnerabilities/cve-2016-9962",
              "refsource": "CONFIRM",
              "url": "https://access.redhat.com/security/vulnerabilities/cve-2016-9962"
            },
            {
              "name": "FEDORA-2017-dbc2b618eb",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAXJMMLRU7DD2IMG47SR2K4BOFFG7FZ/"
            },
            {
              "name": "FEDORA-2017-0200646669",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVM7FCOQMPKOFLDTUYSS4ES76DDM56VP/"
            },
            {
              "name": "20170111 Re: [oss-security] Docker 1.12.6 - Security Advisory",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/540001/100/0/threaded"
            },
            {
              "name": "20170110 Docker 1.12.6 - Security Advisory",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2017/Jan/21"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-9962",
    "datePublished": "2017-01-31T22:00:00.000Z",
    "dateReserved": "2016-12-15T00:00:00.000Z",
    "dateUpdated": "2024-08-06T03:07:31.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2017-00924

CVE-2016-9962 (GCVE-0-2016-9962)

Tags

Sightings

Nomenclature

Related by attack behaviour