GitHub Advisoryadvisory · Go

GHSA-vfjc-2qcw-j95j Docker Moby /proc/scsi Path Exposure Allows Host Data Loss (SCSI MICDROP)

MEDIUM Published 2022-05-17 Modified 2026-01-29 Official page ↗
Aliases
CVE-2017-16539
Ecosystem
Go
Packages
github.com/moby/moby
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-200
Reviewed
2026-01-29

Affected packages

• Go github.com/moby/moby: < 17.12.0-ce → fixed in 17.12.0-ce

Description

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.

Related

Alias · CVE (1)

  • CVE-2017-16539 The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References