Read the docs
TI-2016-08068 Aliases CVE-2016-9962GHSA-gp4j-w3vj-7299

RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of…

Priority LOW 29CWE-362Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.

Why it matters now

EPSS 0.00412 35th percentileScored 2026-11-07
Fix Fixed github.com/opencontainers/runc (Go): 1.0.0-rc3Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/opencontainers/runc (Go)before 1.0.0-rc31.0.0-rc3Patch availableGHSA-gp4j-w3vj-7299
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/opencontainers/runc (Go) Vendor— Affected before 1.0.0-rc3 Fixed in 1.0.0-rc3 Patch available GHSA-gp4j-w3vj-7299

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:*1.11.0 to before 1.12.6VulnerableDocker
  • cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:* Versions 1.11.0 to before 1.12.6 Vulnerable ·Docker

Remediation

  • Fix · GHSA-gp4j-w3vj-7299 github.com/opencontainers/runc (Go) Fixed in 1.0.0-rc3 Advisory →

Red Hat 3 advisories

  • RHSA-2017:0127 Released 2017-01-17 · Red Hat rating Moderate
    runc security and bug fix update
    • Red Hat Enterprise Linux 7 Extras runc-1.0.0-1.rc2.el7
  • RHSA-2017:0123 Released 2017-01-17 · Red Hat rating Moderate
    docker-latest security, bug fix, and enhancement update
    • Red Hat Enterprise Linux 7 Extras docker-client-latest-1.12.5-14.el7, docker-latest-1.12.5-14.el7, docker-latest-logrotate-1.12.5-14.el7 +1
  • RHSA-2017:0116 Released 2017-01-17 · Red Hat rating Moderate
    docker security, bug fix, and enhancement update
    • Red Hat Enterprise Linux 7 Extras container-selinux-2:1.12.5-14.el7, docker-2:1.12.5-14.el7, docker-client-2:1.12.5-14.el7 +6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7 ExtrasFixed RHSA-2017:0116, RHSA-2017:0123, RHSA-2017:0127

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-9962
  2. 2026-10-03 Alias added: GHSA-gp4j-w3vj-7299

References

Patch 1

Advisory 13

Other 7

  • TI-2019-11833 Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by… KEVCVSS 3.1HIGH 7.8
  • TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
  • TI-2019-10626 In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code… CVSS 3.1CRITICAL 9.8
  • TI-2014-07591 Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a… CVSS 2.0HIGH 10.0
  • TI-2014-00046 Improper input validation in docker.io CVSS 3.1CRITICAL 9.8
  • TI-2014-07590 Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to… CVSS 3.1HIGH 8.6
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences