Published: 18/05/2015 Updated: 07/11/2023

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Libcontainer and Docker Engine prior to 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.

Vulnerable Product	Search on Vulmon	Subscribe to Product
docker libcontainer
docker docker

Debian Bug report logs - #784726 dockerio: CVE-2015-3627 CVE-2015-3629 CVE-2015-3630 CVE-2015-3631 Package: src:dockerio; Maintainer for src:dockerio is Dmitry Smirnov <onlyjob@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 8 May 2015 04:57:01 UTC Severity: grave Tags: fixed-upstrea ...

The file-descriptor passed by libcontainer to the pid-1 process of a container has been found to be opened prior to performing the chroot, allowing insecure open and symlink traversal This allows malicious container images to trigger a local privilege escalation (CVE-2015-3627) Libcontainer version 160 introduced changes which facilitated a mou ...

Libcontainer and Docker Engine before 161 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image ...

Description CVE info extractor: use NVD CPE api to retrieve CVES(by using version number, product name) and use openCVE api to fetch CVE details (OpenCVE is faster than NVD Api but dont provide products version number researsh) Volumes /CVE_extractor/OPSToolsjson:/home/OPSToolsjson /CVE_extractor/configjson:/home/configjson confi

CWE-59 http://seclists.org/fulldisclosure/2015/May/28 http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=784726 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2015-3627 https://alas.aws.amazon.com/ALAS-2015-522.html

CVE-2015-3627

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect