Critical Remote Code Execution Vulnerability in Docker 1.3.2
Summary
CVE-2014-9357: Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction. Affects docker.io versions < 1.3.3~dfsg1-1. Fixed in 1.3.3~dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker is an open-source platform that automates the deployment of applications inside lightweight containers. It allows developers to package applications with all their dependencies into a standardized unit for software development. Docker 1.3.2, a version of this platform, has been identified to have a significant vulnerability that could allow remote attackers to execute arbitrary code with root privileges.
Vulnerability Detail
The vulnerability, identified as CVE-2014-9357, arises from the way Docker 1.3.2 handles LZMA (.xz) archives during image extraction and builds in Dockerfiles. Specifically, a crafted image or build can exploit the chroot mechanism used for archive extraction, allowing attackers to execute arbitrary code with root privileges. This poses a severe risk as it can lead to unauthorized access and control over the affected system.
How To Fix
Minimum fixed version
1.3.3~dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade docker.ioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider restricting access to the Docker daemon to trusted users only. This can be done by modifying the Docker group settings and ensuring that only authorized personnel have access to execute Docker commands.
Conclusion
The vulnerability CVE-2014-9357 in Docker 1.3.2 poses a significant threat by allowing remote code execution with root privileges. Users are strongly advised to upgrade to version 1.3.3 or later to mitigate this risk. Additionally, implementing access controls can provide temporary protection until an upgrade can be performed.
See every vulnerability recorded for docker.io →
FAQ
CVE-2014-9357 is a vulnerability in Docker 1.3.2 that allows remote attackers to execute arbitrary code with root privileges through crafted images or builds.
You can check if your Docker installation is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities.
The risks include unauthorized access to the system, potential data breaches, and the ability for attackers to manipulate or control the affected environment.
Yes, you can mitigate the risk by restricting access to the Docker daemon and ensuring that only trusted users can execute Docker commands.
If immediate upgrading is not feasible, implement strict access controls and monitor your Docker environment for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for docker.io.
