Docker Engine Vulnerability CVE-2015-3630: Weak Permissions Leading to Host Modification
Summary
CVE-2015-3630: Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perf... Affects docker.io versions < 1.6.1+dfsg1-1. Fixed in 1.6.1+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker is an open-source platform that automates the deployment of applications inside software containers. It allows developers to package applications with all their dependencies into a standardized unit for software development. Docker Engine is the core component that enables this functionality. However, prior to version 1.6.1, Docker Engine had weak permissions set for certain system files, which could be exploited by local users.
Vulnerability Detail
CVE-2015-3630 is a vulnerability in Docker Engine versions before 1.6.1 that allows local users to exploit weak permissions on system files such as /proc/asound, /proc/timer_stats, /proc/latency_stats, and /proc/fs. This vulnerability can lead to unauthorized modifications of the host system, exposure of sensitive information, and potential protocol downgrade attacks through crafted Docker images. The issue arises from insufficient access controls that fail to restrict local users from accessing critical system resources.
How To Fix
Minimum fixed version
1.6.1+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade docker.ioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider restricting access to the affected files by modifying their permissions. Use the following command to change permissions:
sudo chmod 700 /proc/asound /proc/timer_stats /proc/latency_stats /proc/fs
This command restricts access to the owner only, but it is a temporary measure and does not fully mitigate the vulnerability.
Conclusion
CVE-2015-3630 is a significant vulnerability in Docker Engine that poses risks to system integrity and security. It is crucial for users to upgrade to version 1.6.1 or later to mitigate these risks. Additionally, temporary workarounds can be applied, but they do not replace the need for an upgrade.
See every vulnerability recorded for docker.io →
FAQ
CVE-2015-3630 is a vulnerability in Docker Engine that allows local users to exploit weak permissions on certain system files, potentially leading to unauthorized access and modifications.
Docker Engine versions prior to 1.6.1 are affected by this vulnerability.
You can check your Docker version by running the command 'docker --version' in your terminal. If it is below 1.6.1, it is vulnerable.
The risks include unauthorized modifications to the host system, exposure of sensitive information, and the possibility of protocol downgrade attacks.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application against vulnerabilities without any signup at the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for docker.io.
