Skip to content
Fencer Vulns
medium 6.4

CVE-2016-9962 json

Information Exposure in RunC

published 2017-01-31 9 y ago modified 2026-09-10 1 mo ago also GHSA-gp4j-w3vj-7299 , GO-2022-0835 , EUVD-2021-2523

cvss
6.4
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits
0
none known

Summary

RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.

Patch / fix

  • go github.com/opencontainers/runc 1.0.0-rc3
  • docker docker 1.12.6
  • runc Debian 14, Debian 13, Debian 12 0.1.1+dfsg1-2
  • docker.io Debian 14, Debian 13, Debian 12 1.13.1~ds1-2

debian advisories DEBIAN-CVE-2016-9962

  • runc Ubuntu 18.04 LTS 1.0.0~rc2+docker1.13.1-0ubuntu1
  • docker.io Ubuntu 16.04 LTS 1.13.1-0ubuntu1~16.04.2

ubuntu advisories UBUNTU-CVE-2016-9962

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • runc RHEL 7 EXTRAS_OTHER 1.0.0-1.rc2.el7
  • docker RHEL 7 EXTRAS_OTHER 2:1.12.5-14.el7
  • docker-client RHEL 7 EXTRAS_OTHER 2:1.12.5-14.el7
  • docker-common RHEL 7 EXTRAS_OTHER 2:1.12.5-14.el7
  • docker-logrotate RHEL 7 EXTRAS_OTHER 2:1.12.5-14.el7
  • container-selinux RHEL 7 EXTRAS_OTHER 2:1.12.5-14.el7
  • docker-lvm-plugin RHEL 7 EXTRAS_OTHER 2:1.12.5-14.el7
  • docker-v1.10-migrator RHEL 7 EXTRAS_OTHER 2:1.12.5-14.el7

red hat advisories RHSA-2017:0127RHSA-2017:0116RHSA-2017:0123

  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 24.0.9_ce-150000.1.25.1
  • docker SLE Module for Containers 12, OpenStack Cloud 6-LTSS 18.09.1_ce-98.34.2
  • containerd SLE Module for Containers 12, OpenStack Cloud 6-LTSS 1.2.2-16.14.2
  • docker-runc SLE Module for Containers 12, OpenStack Cloud 6-LTSS 1.0.0rc6+gitr3748_96ec2177ae84-1.17.2
  • golang-github-docker-libnetwork SLE Module for Containers 12, OpenStack Cloud 6-LTSS 0.7.0.1+gitr2711_2cfbf9b1f981-16.2
  • runc SLE Module for Containers 12, OpenStack Cloud 6 0.1.1+gitr2819_50a19c6-15.2
  • docker SLE Module for Containers 12, OpenStack Cloud 6 1.12.6-87.2
  • containerd SLE Module for Containers 12, OpenStack Cloud 6 0.2.5+gitr569_2a5e70c-15.3

suse advisories SUSE-SU-2025:03545-1SUSE-SU-2025:03540-1SUSE-SU-2019:0573-1SUSE-SU-2017:1964-1

  • docker-stable openSUSE Tumbleweed 24.0.9_ce-15.1
  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250807T150727-1.1
  • containerd openSUSE Tumbleweed 1.4.8-2.2
  • docker openSUSE Tumbleweed 20.10.6_ce-2.1
  • runc openSUSE Tumbleweed 1.0.2-1.2

opensuse advisories openSUSE-SU-2025:15589-1openSUSE-SU-2025:15424-1openSUSE-SU-2024:10693-1openSUSE-SU-2024:10722-1openSUSE-SU-2024:11358-1

  • docker Arch Linux 1:1.12.6-1
  • runc Arch Linux 1.0.0rc5+19+g69663f0b-1

arch linux advisories AVG-133AVG-134

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-9962 updated cvss 7.5

docker: insecure opening of file-descriptor allows privilege escalation

  • Red Hat Enterprise Linux 7 Extras docker 1.12.5-14.el7, runc 1.0.0-1.rc2.el7, docker-client 1.12.5-14.el7, docker-common 1.12.5-14.el7, docker-latest 1.12.5-14.el7, docker-logrotate 1.12.5-14.el7, +8 more
    fixed: vendor fix RHSA-2017:0116

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 6.4 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P
GitHub 3.0 6.4 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/opencontainers/runc
<1.0.0-rc3
1.0.0-rc3

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.