GitHub Advisoryadvisory · Go

GHSA-g7v2-2qxx-wjrw Symlink Attack in Libcontainer and Docker Engine

MEDIUM Published 2022-02-15 Modified 2021-05-20 Official page ↗
Aliases
CVE-2015-3627
Ecosystem
Go
Packages
github.com/docker/docker
Severity
Moderate
Weaknesses
CWE-59
Reviewed
2021-05-20

Affected packages

• Go github.com/docker/docker: < 1.6.1 → fixed in 1.6.1

Description

Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.

Related

Alias · CVE (1)

  • CVE-2015-3627 Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which… vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References