01 Record

CVE-2016-3697

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric

UnratedPUBLISHEDCNA: redhat

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.38% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 32.6% of scored records. A rank, not a probability.
NVD base score: 7.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2016-06-01 20:00Z10 YR AGO

Last updated

2024-08-06 00:03Z2 YR AGO

Reserved

2016-03-30

Assigning CNA

redhat

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-264

Data version

5.1

Document digest

d60426c7a811079514ec5076748b7b2e39440b352b8b1f6023036e26f0ee2466

05 Affected products

VendorProductVersionsPlatforms

dockerdockerNot specified—

linuxfoundationruncNot specified—

opensuseopensuseNot specified—

redhatopenshiftNot specified—

redhatrhel_extras_otherNot specified—

06 References

rhn.redhat.comRHSA-2016:1034http://rhn.redhat.com/errata/RHSA-2016-1034.htmlvendor-advisoryx_refsource_REDHAT
github.comhttps://github.com/opencontainers/runc/releases/tag/v0.1.0x_refsource_CONFIRM
lists.opensuse.orgopenSUSE-SU-2016:1417http://lists.opensuse.org/opensuse-updates/2016-05/msg00111.htmlvendor-advisoryx_refsource_SUSE
github.comhttps://github.com/docker/docker/issues/21436x_refsource_CONFIRM
github.comhttps://github.com/opencontainers/runc/pull/708x_refsource_CONFIRM
rhn.redhat.comRHSA-2016:2634http://rhn.redhat.com/errata/RHSA-2016-2634.htmlvendor-advisoryx_refsource_REDHAT
github.comhttps://github.com/opencontainers/runc/commit/69af385de62ea68e2e608335cffbb0f4aa3db091x_refsource_CONFIRM
security.gentoo.orgGLSA-201612-28https://security.gentoo.org/glsa/201612-28vendor-advisoryx_refsource_GENTOO

07 Fixed in

Debian 12

runc
Fixed in 0.1.0+dfsg-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

runc
Fixed in 0.1.0+dfsg-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

runc
Fixed in 0.1.0+dfsg-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.