1. Ubuntu Security Notices
  2. USN-4574-1

USN-4574-1: libseccomp-golang vulnerability

Publication date

7 October 2020

Overview

A system hardening measure could be bypassed.

Releases

Packages

Details

It was discovered that libseccomp-golang did not properly generate BPFs. If
a process were running under a restrictive seccomp filter that specified
multiple syscall arguments, the application could potentially bypass the
intended restrictions put in place by seccomp.

It was discovered that libseccomp-golang did not properly generate BPFs. If
a process were running under a restrictive seccomp filter that specified
multiple syscall arguments, the application could potentially bypass the
intended restrictions put in place by seccomp.

Update instructions

After a standard system update anything that depends on libseccomp-golang needs to be rebuilt to make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
16.04 xenial golang-github-seccomp-libseccomp-golang-dev –  0.0~git20150813.0.1b506fc-2+deb9u1build0.16.04.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›