PT-2015-6251 · Docker+2 · Docker Engine+3
CVSS v3.1
5.1
Medium
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Docker Engine versions prior to 1.6.1
Description
The issue allows local users to set arbitrary Linux Security Modules (LSM) and docker t policies via an image that allows volumes to override files in /proc. This can be achieved by exploiting the ability of Docker Engine to allow volumes to override files in the /proc directory, potentially leading to unauthorized access or modifications to system configurations.
Recommendations
For Docker Engine versions prior to 1.6.1, update to version 1.6.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of volumes that can override files in /proc to minimize the risk of exploitation. Avoid using images that allow volumes to override sensitive system files until the issue is resolved.
Fix
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Docker
Docker Engine
Suse