CVE-2015-3630 Information Exposure in Docker Engine
HighCVSS 7.2
EPSS 0.55%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| docker github.com/docker/docker(Go) | >= 1.6.0, < 1.6.1 | 1.6.1 |
| debian/docker.io(Debian:12) | < 1.6.1+dfsg1-1 | 1.6.1+dfsg1-1 |
| debian/docker.io(Debian:13) | < 1.6.1+dfsg1-1 | 1.6.1+dfsg1-1 |
| debian/docker.io(Debian:14) | < 1.6.1+dfsg1-1 | 1.6.1+dfsg1-1 |
| docker github.com/docker/docker | <= 1.6 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- groups.google.com
- lists.opensuse.org
- packetstormsecurity.com exploit
- seclists.org
- web.nvd.nist.gov
- www.securityfocus.com
- github.com vendor-advisory
- Debian Security Tracker CVE-2015-3630 vendor-advisory
- openSUSE-SU-2015:0905 vendor-advisory
- packetstormsecurity.com
- 20150508 Docker 1.6.1 - Security Advisory [150507] mailing-list
- 74566 vdb-entry
- bugs.debian.org issue-tracking