Local User Container Escape Vulnerability in Docker.io - CVE-2015-3629
Summary
CVE-2015-3629: Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a c... Affects docker.io versions < 1.6.1+dfsg1-1. Fixed in 1.6.1+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker.io is a widely used containerization platform that allows developers to package applications and their dependencies into containers. These containers provide a lightweight and portable environment for running applications. However, Docker.io versions prior to 1.6.1 are susceptible to a vulnerability that allows local users to escape the container environment, potentially compromising the host system.
Vulnerability Detail
The vulnerability, identified as CVE-2015-3629, arises from a flaw in Libcontainer, which is utilized by Docker Engine. This flaw enables local users to perform a symlink attack within a Docker image, leading to a mount namespace breakout. As a result, attackers can write to arbitrary files on the host system, posing significant security risks, including unauthorized data access and system manipulation.
How To Fix
Minimum fixed version
1.6.1+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade docker.ioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to Docker containers by limiting user permissions and avoiding the use of untrusted images. Additionally, consider using alternative containerization solutions until the upgrade is completed.
Conclusion
CVE-2015-3629 represents a significant security vulnerability in Docker.io that can lead to serious consequences if not addressed. Upgrading to the latest version is crucial to ensure the security of your containerized applications and the host system.
See every vulnerability recorded for docker.io →
FAQ
CVE-2015-3629 is a vulnerability in Docker.io that allows local users to escape the container environment and write to arbitrary files on the host system.
You can check your Docker version by running 'docker --version' in the terminal. If it is below 1.6.1, it is affected by this vulnerability.
The risks include unauthorized access to host files, potential data breaches, and the ability for attackers to manipulate the host system.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Detailed information can be found on the official CVE website or through security advisories related to Docker.io.
Related vulnerabilities
Recent vulnerabilities recorded for docker.io.
