Published: 18/05/2015 Updated: 02/02/2024

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.

Vulnerable Product	Search on Vulmon	Subscribe to Product
docker libcontainer 1.6.0
opensuse opensuse 13.2

Debian Bug report logs - #784726 dockerio: CVE-2015-3627 CVE-2015-3629 CVE-2015-3630 CVE-2015-3631 Package: src:dockerio; Maintainer for src:dockerio is Dmitry Smirnov <onlyjob@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 8 May 2015 04:57:01 UTC Severity: grave Tags: fixed-upstrea ...

The file-descriptor passed by libcontainer to the pid-1 process of a container has been found to be opened prior to performing the chroot, allowing insecure open and symlink traversal This allows malicious container images to trigger a local privilege escalation (CVE-2015-3627) Libcontainer version 160 introduced changes which facilitated a mou ...

Libcontainer 160, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container ...

CWE-59 http://seclists.org/fulldisclosure/2015/May/28 http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html http://www.securityfocus.com/bid/74558 http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=784726 https://nvd.nist.gov https://alas.aws.amazon.com/ALAS-2015-522.html https://access.redhat.com/security/cve/cve-2015-3629

CVE-2015-3629

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect