Read the docs
TI-2016-03129 Aliases CVE-2016-3697GHSA-q3j5-32m5-58c2

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2…

Priority LOW 34CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-264 and CWE-269.

Summary

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.

Why it matters now

EPSS 0.00388 33rd percentileScored 2026-11-07
Fix Partial github.com/opencontainers/runc (Go): 0.1.0Red Hat: 2 advisoriesRed Hat: 1 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/opencontainers/runc (Go)before 0.1.00.1.0Patch availableGHSA-q3j5-32m5-58c2
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/opencontainers/runc (Go) Vendor— Affected before 0.1.0 Fixed in 0.1.0 Patch available GHSA-q3j5-32m5-58c2

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:*up to 1.11.1VulnerableDocker
cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*up to 0.0.9Vulnerablebackstage
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*13.2VulnerableopenSUSE
  • cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:* Versions up to 1.11.1 Vulnerable ·Docker
  • cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* Versions up to 0.0.9 Vulnerable ·backstage
  • cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·openSUSE

Remediation

  • Fix · GHSA-q3j5-32m5-58c2 github.com/opencontainers/runc (Go) Fixed in 0.1.0 Advisory →

Red Hat 2 advisories

  • RHSA-2016:2634 Released 2016-11-03 · Red Hat rating Moderate
    docker security and bug fix update
    • Red Hat Enterprise Linux 7 Extras docker-1.10.3-57.el7, docker-common-1.10.3-57.el7, docker-logrotate-1.10.3-57.el7 +5
  • RHSA-2016:1034 Released 2016-05-12 · Red Hat rating Moderate
    docker security, bug fix, and enhancement update
    • Red Hat Enterprise Linux 7 Extras docker-1.9.1-40.el7, docker-common-1.9.1-40.el7, docker-forward-journald-1.9.1-40.el7 +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Enterprise 3AffectedNo fix yet
Red Hat Enterprise Linux 7 ExtrasFixed RHSA-2016:1034, RHSA-2016:2634

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-3697
  2. 2026-10-03 Alias added: GHSA-q3j5-32m5-58c2

References

Patch 2

Advisory 7

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences