USN-4574-1: libseccomp-golang vulnerability

07 October 2020

A system hardening measure could be bypassed.



  • golang-github-seccomp-libseccomp-golang - a Go-based interface to the libseccomp library


It was discovered that libseccomp-golang did not properly generate BPFs. If
a process were running under a restrictive seccomp filter that specified
multiple syscall arguments, the application could potentially bypass the
intended restrictions put in place by seccomp.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.04

After a standard system update anything that depends on libseccomp-golang needs
to be rebuilt to make all the necessary changes.