CVE-2017-18367 – libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access restrictions

https://notcve.org/view.php?id=CVE-2017-18367

libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument. libseccomp-golang versión 0.9.0 y anteriores, BPF generan incorrectamente múltiples argumentos OR en lugar de ANDing. Un proceso que se realiza bajo un filtro seccomp restrictivo que especificó múltiples argumentos de syscall podría omitir las restricciones de acceso previstas al especificar un único argumento coincidente. • http://www.openwall.com/lists/oss-security/2019/04/25/6 https://access.redhat.com/errata/RHSA-2019:4087 https://access.redhat.com/errata/RHSA-2019:4090 https://github.com/seccomp/libseccomp-golang/commit/06e7a29f36a34b8cf419aeb87b979ee508e58f9e https://github.com/seccomp/libseccomp-golang/issues/22 https://lists.debian.org/debian-lts-announce/2020/08/msg00016.html https://usn.ubuntu.com/4574-1 https://access.redhat.com/security/cve/CVE-2017-18367 https://bugzilla.redhat.com/show_bug • CWE-20: Improper Input Validation CWE-305: Authentication Bypass by Primary Weakness •