Arbitrary File Override in Docker Engine

BASSO 3.6CVE-2015-3631 · GHSA-v4h8-794j-g8mm · GO-2022-0708 · Published 18/05/2015 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/docker/docker Go	`< 1.6.1`	`1.6.1`
docker docker	`≤ 1.6`	No fix yet

Description

Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.

NVD description

Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.

References

nvd.nist.gov/vuln/detail/CVE-2015-3631 · ADVISORY
moby/moby · PACKAGE
moby/moby · WEB
groups.google.com/forum · WEB
groups.google.com/forum · WEB
web.nvd.nist.gov/view/vuln/detail · WEB
lists.opensuse.org/opensuse-updates/2015-05/msg00023.html · WEB
packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html · WEB
seclists.org/fulldisclosure/2015/May/28 · WEB
GitHub Advisory GHSA-v4h8-794j-g8mm · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free