CVE-2015-3629 Arbitrary File Write in Libcontainer
HighCVSS 7.8
EPSS 0.60%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| docker github.com/docker/docker(Go) | >= 1.6.0, < 1.6.1 | 1.6.1 |
| debian/docker.io(Debian:12) | < 1.6.1+dfsg1-1 | 1.6.1+dfsg1-1 |
| debian/docker.io(Debian:13) | < 1.6.1+dfsg1-1 | 1.6.1+dfsg1-1 |
| debian/docker.io(Debian:14) | < 1.6.1+dfsg1-1 | 1.6.1+dfsg1-1 |
| docker libcontainer | = 1.6.0 | No fix listed |
| opensuse | = 13.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- groups.google.com permissions-required
- web.nvd.nist.gov
- openSUSE-SU-2015:0905 mailing-list third-party-advisory vendor-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20150508 Docker 1.6.1 - Security Advisory [150507] mailing-list third-party-advisory
- 74558 broken-link third-party-advisory vdb-entry
- github.com vendor-advisory
- Debian Security Tracker CVE-2015-3629 vendor-advisory
- bugs.debian.org issue-tracking