CVE-2015-3631 Arbitrary File Override in Docker Engine
LowCVSS 3.6
EPSS 0.57%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| docker github.com/docker/docker(Go) | < 1.6.1 | 1.6.1 |
| debian/docker.io(Debian:12) | < 1.6.1+dfsg1-1 | 1.6.1+dfsg1-1 |
| debian/docker.io(Debian:13) | < 1.6.1+dfsg1-1 | 1.6.1+dfsg1-1 |
| debian/docker.io(Debian:14) | < 1.6.1+dfsg1-1 | 1.6.1+dfsg1-1 |
| docker github.com/docker/docker | <= 1.6 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- github.com
- groups.google.com
- web.nvd.nist.gov
- openSUSE-SU-2015:0905 vendor-advisory
- packetstormsecurity.com exploit
- 20150508 Docker 1.6.1 - Security Advisory [150507] mailing-list
- github.com vendor-advisory
- Debian Security Tracker CVE-2015-3631 vendor-advisory
- bugs.debian.org issue-tracking