PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9962 Docker CVE debrief

CVE-2016-9962 describes a container-runtime isolation flaw in which additional processes started through runc exec could be ptraced by PID 1 inside the container during initialization. According to the record, that timing window could expose file descriptors and allow modification of runC state or container escape. NVD rates the issue CVSS 6.4 (medium), but the impact is serious for affected hosts because the result can cross container boundaries.

Vendor
Docker
Product
Unknown
CVSS
MEDIUM 6.4
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Operators running affected Docker Engine / runc versions, especially on shared or multi-tenant Linux hosts, should care most. This also matters for distro maintainers and platform teams that package or orchestrate Docker-based workloads, particularly where containers run with root inside the container or rely heavily on exec-style process launches.

Technical summary

NVD maps this CVE to CWE-362 and scores it CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. The supplied description says runc allowed extra container processes created via runc exec to be ptraced by the container’s PID 1 during initialization, before the process was fully placed inside the container. That can expose file descriptors and permit container escape or alteration of runC state.

Defensive priority

Medium priority overall, with expedited patching recommended for any production host running affected Docker/runc packages. The vulnerability requires local access and high privileges, but the potential outcome includes container escape and full confidentiality, integrity, and availability impact on the affected environment.

Recommended defensive actions

  • Upgrade Docker/runc to a version that includes the upstream fix; the NVD CPE range for Docker ends before 1.12.6, and the record includes a Docker 1.12.6 release reference.
  • Inventory hosts, packages, and orchestration nodes to identify any affected Docker Engine / runc installations before normal maintenance windows.
  • Review workloads that depend on container-root privileges or frequent runc exec usage and reduce privilege where possible.
  • Apply the vendor and distribution guidance referenced in the record, including Red Hat, Fedora, and Gentoo advisories.
  • After patching, verify runtime versions and confirm normal container exec workflows still behave as expected.

Evidence notes

This debrief is based only on the supplied CVE/NVD metadata and listed references. The record provides the official CVSS vector, CWE-362 mapping, and affected Docker CPE range (1.11.0 through before 1.12.6), plus references to Docker 1.12.6, an upstream runc patch commit, and vendor/distro advisories. No exploit code or unsupported operational details are included.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9962 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9962

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9962 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9962

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.