CVE-2015-3631: Arbitrary File Override in Docker Engine
Summary
CVE-2015-3631: Arbitrary File Override in Docker Engine. Affects github.com/docker/docker versions < 1.6.1. Fixed in 1.6.1. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2015-3631 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker Engine is an open-source containerization platform that allows developers to automate the deployment and management of applications within containers. It provides a lightweight and portable runtime environment for applications, enabling them to run consistently across different systems. Docker Engine is written in Go and is widely used in the software development industry.
Vulnerability Detail
The vulnerability, identified as CVE-2015-3631, affects Docker Engine versions prior to 1.6.1. It allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies by exploiting an image that permits volumes to override files in the /proc directory. This vulnerability can be leveraged to bypass security restrictions and potentially gain unauthorized access to sensitive resources or execute arbitrary code within the containerized environment.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.1
This is the first release that contains the fix.
go get github.com/docker/docker@v1.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually restrict access to the /proc directory within the container by modifying the container's security policies. This can be achieved by configuring appropriate Linux Security Modules (LSM) and docker_t policies to prevent volumes from overriding files in /proc. However, applying this workaround may require advanced knowledge of container security and may not provide complete protection against all possible attack vectors.
Conclusion
In conclusion, the vulnerability CVE-2015-3631 poses a moderate risk to systems running Docker Engine versions prior to 1.6.1. It allows local users to manipulate security policies and potentially gain unauthorized access or execute arbitrary code within containers. Upgrading to the latest version of Docker Engine or applying the recommended workaround can help mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Docker Engine is an open-source containerization platform that automates the deployment and management of applications within containers.
The vulnerability allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies, potentially leading to unauthorized access or arbitrary code execution within the containerized environment.
Versions of Docker Engine prior to 1.6.1 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade Docker Engine to version 1.6.1 or later.
A workaround involves manually restricting access to the /proc directory within the container by modifying security policies.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
