CVE-2015-3627
Symlink Attack in Libcontainer and Docker Engine
Summary
Symlink Attack in Libcontainer and Docker Engine
Original description
The description as published by the source.
Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Go
github.com/docker/docker
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.1"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2015-3627 docker.io Fixed in: 1.6.1+dfsg1-1
References
- advisory nvd.nist.gov
- web github.com
- web groups.google.com
- web groups.google.com
- web lists.opensuse.org
- web packetstormsecurity.com
- web seclists.org