Docker Moby /proc/scsi Path Exposure Allows Host Data Loss (SCSI MICDROP)

MEDIO 5.9CVE-2017-16539 · GHSA-vfjc-2qcw-j95j · Published 04/11/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/moby/moby Go	`< 17.12.0-ce`	`17.12.0-ce`
moby mobyproject	`≤ 17.03.2`	No fix yet

Description

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-16539 · ADVISORY
moby/moby#35399 · WEB
moby/moby commit a21ecdf · WEB
moby/moby · PACKAGE
marc.info · WEB
marc.info · WEB
twitter.com/ewindisch/status/926443521820774401 · WEB
moby/moby#35399 · Issue Tracking

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free