Privilege Escalation Vulnerability in Docker.io - CVE-2015-3627
Summary
CVE-2015-3627: Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image. Affects docker.io versions < 1.6.1+dfsg1-1. Fixed in 1.6.1+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker.io is a widely used containerization platform that allows developers to automate the deployment of applications inside lightweight containers. It provides a consistent environment for applications, making it easier to develop, ship, and run software. However, prior to version 1.6.1, Docker.io had a vulnerability that could allow local users to exploit file descriptors, leading to potential privilege escalation.
Vulnerability Detail
The vulnerability, identified as CVE-2015-3627, arises from the way Libcontainer and Docker Engine handle file descriptors. Specifically, before performing a chroot operation, the system opens the file descriptor passed to the pid-1 process. This flaw allows local users to create a symlink to a sensitive file, which can be exploited to gain elevated privileges within the container. The ramifications of this vulnerability can be severe, as it compromises the security model of containerized applications, potentially allowing unauthorized access to sensitive data or system resources.
How To Fix
Minimum fixed version
1.6.1+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade docker.ioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the Docker daemon and ensure that only trusted users have permission to execute Docker commands. This can be done by configuring user permissions and using group management to restrict access.
Conclusion
CVE-2015-3627 represents a significant security risk for users of Docker.io prior to version 1.6.1. It is crucial for users to upgrade their installations to mitigate the risk of privilege escalation. By following the outlined steps and utilizing tools like Vulert, users can ensure their applications remain secure against this vulnerability.
See every vulnerability recorded for docker.io →
FAQ
CVE-2015-3627 is a vulnerability in Docker.io that allows local users to escalate privileges through a symlink attack due to improper handling of file descriptors.
You can check if your Docker installation is affected by using Vulert, which monitors open-source vulnerabilities. Simply upload your manifest file like package-lock.json to Vulert's playground at Vulert Scanner.
The risks include unauthorized access to sensitive data, the ability to execute arbitrary commands, and the compromise of the security of containerized applications.
Yes, you can mitigate the risk by restricting access to the Docker daemon and ensuring that only trusted users can execute Docker commands.
If an immediate upgrade is not possible, implement strict access controls and monitor your Docker environment for any suspicious activities until you can apply the fix.
Related vulnerabilities
Recent vulnerabilities recorded for docker.io.
