PT-2015-6247 · Docker+2 · Docker Engine+4

Tõnis Tiigi

·

Published

2015-05-08

·

Updated

2025-10-11

·

CVE-2015-3627

CVSS v2.0

7.2

High

VectorAV:L/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Docker Engine versions prior to 1.6.1 Libcontainer versions prior to 1.6.1
Description The issue allows local users to gain privileges via a symlink attack in an image. This occurs because Libcontainer and Docker Engine open the file-descriptor passed to the pid-1 process before performing the chroot.
Recommendations For Docker Engine versions prior to 1.6.1, update to version 1.6.1 or later to resolve the issue. For Libcontainer versions prior to 1.6.1, update to version 1.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the pid-1 process to minimize the risk of exploitation.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

ALT-PU-2015-1429
CVE-2015-3627
GHSA-G7V2-2QXX-WJRW
GO-2022-0649
OPENSUSE-SU-2024:10532-1
OPENSUSE-SU-2025:15589-1
SUSE-SU-2015:0984-1
SUSE-SU-2015_0984-1
SUSE-SU-2025:03540-1
SUSE-SU-2025:03545-1

Affected Products

Alt Linux
Docker
Docker Engine
Libcontainer
Suse