CVE-2015-3629: Arbitrary File Write in Libcontainer
Summary
CVE-2015-3629: Arbitrary File Write in Libcontainer. Affects github.com/docker/docker versions >= 1.6.0, < 1.6.1. Fixed in 1.6.1. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2015-3629 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libcontainer is a package in the Go ecosystem used by Docker Engine. It provides containerization functionality, allowing users to run applications in isolated environments. Libcontainer version 1.6.0 is affected by a vulnerability that enables local users to escape containerization and write to arbitrary files on the host system. This vulnerability occurs when respawning a container and can be exploited through a symlink attack in an image.
Vulnerability Detail
The vulnerability in Libcontainer 1.6.0 allows an attacker with local access to a container to break out of the container's mount namespace and write to files on the host system. By creating a symbolic link in the image used for container spawning, the attacker can manipulate the container's file system and gain unauthorized access to sensitive files on the host. This can lead to unauthorized data disclosure, modification, or destruction on the host system.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.1
This is the first release that contains the fix.
go get github.com/docker/docker@v1.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched version of Libcontainer.
Conclusion
The vulnerability in Libcontainer 1.6.0 allows local users to escape containerization and write to arbitrary files on the host system. To mitigate this risk, it is recommended to upgrade to Libcontainer version 1.6.1 or later. This will prevent the symlink attack and ensure the container remains within its mount namespace. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Libcontainer is a package in the Go ecosystem used by Docker Engine to provide containerization functionality. It allows users to run applications in isolated environments.
This vulnerability allows local users to escape containerization and write to arbitrary files on the host system. It can lead to unauthorized access, modification, or destruction of sensitive files on the host.
The vulnerability can be exploited by creating a symbolic link in the image used for container spawning. This allows an attacker to manipulate the container's file system and gain unauthorized access to files on the host system.
Yes, the vulnerability can be fixed by upgrading to Libcontainer version 1.6.1 or later. This version includes a patch for the symlink attack and prevents the container from escaping its mount namespace.
There are no known workarounds for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched version of Libcontainer.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
