CVE-2015-3627: Symlink Attack in Libcontainer and Docker Engine
Summary
CVE-2015-3627: Symlink Attack in Libcontainer and Docker Engine. Affects github.com/docker/docker versions < 1.6.1. Fixed in 1.6.1. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2015-3627 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/docker/docker, which is written in Go. It is a popular open-source containerization platform that allows developers to automate the deployment and management of applications within containers. Docker Engine is the runtime that executes and manages these containers. The vulnerability affects versions prior to 1.6.1 of Libcontainer and Docker Engine.
Vulnerability Detail
The vulnerability, identified as CVE-2015-3627, arises from a flaw in Libcontainer and Docker Engine. It occurs when the file-descriptor passed to the pid-1 process is opened before performing the chroot operation. This flaw enables local users to gain elevated privileges by exploiting a symlink attack within an image. By creating a malicious symlink, an attacker can manipulate the file-descriptor and gain unauthorized access to sensitive resources or execute arbitrary code within the container. This vulnerability poses a moderate risk and can lead to unauthorized access, privilege escalation, and potential compromise of the host system.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.1
This is the first release that contains the fix.
go get github.com/docker/docker@v1.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating to the latest version of Libcontainer and Docker Engine.
Conclusion
In conclusion, the vulnerability CVE-2015-3627 in Libcontainer and Docker Engine poses a moderate risk to systems running affected versions. To mitigate this vulnerability, it is crucial to update to version 1.6.1 or later of Libcontainer and Docker Engine. Failure to address this vulnerability may result in unauthorized access, privilege escalation, and potential compromise of the host system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Libcontainer is a Go library used by Docker Engine to provide a secure and isolated environment for running containers. It manages the low-level containerization features and interfaces with the underlying operating system to create and manage containers.
A symlink attack, also known as a symbolic link attack, is a security vulnerability that occurs when an attacker creates a symbolic link (symlink) to a sensitive file or directory. By manipulating the symlink, the attacker can trick the system into accessing unintended resources, potentially leading to unauthorized access or privilege escalation.
This vulnerability allows local users to gain elevated privileges within a container. If exploited, an attacker could access sensitive resources, execute arbitrary code, or escalate their privileges. This can lead to unauthorized access, data breaches, and compromise of the host system.
No, only versions prior to 1.6.1 of Libcontainer and Docker Engine are affected by this vulnerability. It is crucial to update to the latest version to mitigate the risk.
There are no known public exploits specifically targeting this vulnerability at the time of writing. However, it is essential to apply the recommended fix to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
