PT-2015-6251 · Docker+2 · Docker Engine+3
Eric Windisch
·
Publicado
2015-05-08
·
Atualizado
2025-10-11
·
CVE-2015-3631
CVSS v3.1
5.1
Média
| Vetor | AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Docker Engine versions prior to 1.6.1
Description
The issue allows local users to set arbitrary Linux Security Modules (LSM) and docker t policies via an image that allows volumes to override files in /proc. This can be achieved by exploiting the ability of Docker Engine to allow volumes to override files in the /proc directory, potentially leading to unauthorized access or modifications to system configurations.
Recommendations
For Docker Engine versions prior to 1.6.1, update to version 1.6.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of volumes that can override files in /proc to minimize the risk of exploitation. Avoid using images that allow volumes to override sensitive system files until the issue is resolved.
Correção
Improper Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Docker
Docker Engine
Suse