GHSA-g44j-7vp3-68cv CVE-2015-3629 GO-2022-0647
Arbitrary File Write in Libcontainer
- Severity
- 8.4 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.60%
- Chance of exploitation in the next 30 days. Higher than 48.87% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
- Fix
1.6.1- Upgrade github.com/docker/docker to this version or later
Description
Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/docker/docker | >= 1.6.0, < 1.6.1 |
1.6.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/docker/docker Go → 1.6.1
- go
go get github.com/docker/docker@v1.6.1 && go mod tidy
Severity breakdown
CVSS 3.1 8.4
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-59: Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
References
Advisories
Other links
- github.com/docker/docker/commit/d5ebb60bddbabea0439213501f4f6ed494b23cba
- groups.google.com/forum
- groups.google.com/forum
- web.nvd.nist.gov/view/vuln/detail
- lists.opensuse.org/opensuse-updates/2015-05/msg00023.html
- packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html
- seclists.org/fulldisclosure/2015/May/28
- securityfocus.com/bid/74558
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-rg2x-37c3-w2rh Docker: Race condition in docker cp allows bind mount redirection to host path | High | Also affects github.com/docker/docker |
| GHSA-vp62-88p7-qqf5 Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap | Medium | Also affects github.com/docker/docker |
| GHSA-x86f-5xw2-fm2r Docker: `PUT /containers/{id}/archive` executes container binary on the host | High | Also affects github.com/docker/docker |
| GO-2026-4887 Moby has AuthZ plugin bypass when provided oversized request bodies | High | Also affects github.com/docker/docker |
| GHSA-pxq6-2prw-chj9 Moby has an Off-by-one error in its plugin privilege validation | High | Also affects github.com/docker/docker |
| GHSA-4vq8-7jfc-9cvp Moby firewalld reload removes bridge network isolation | Medium | Also affects github.com/docker/docker |
| GHSA-x4rx-4gw3-53p4 Moby firewalld reload makes published container ports accessible from remote hosts | Medium | Also affects github.com/docker/docker |
| GHSA-v23v-6jw2-98fq Authz zero length regression | Critical | Also affects github.com/docker/docker |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor