Summary
[1.6.1-1.0.1]
- Update source to 1.6.1 from https://github.com/docker/docker/releases/tag/v1.6.1
Symlink traversal on container respawn allows local privilege escalation (CVE-2015-3629)
Insecure opening of file-descriptor 1 leading to privilege escalation (CVE-2015-3627)
Read/write proc paths allow host modification & information disclosure (CVE-2015-3630)
Volume mounts allow LSM profile escalation (CVE-2015-3631)
AppArmor policy improvements
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | docker | 0:1.6.1-1.0.1.el7 |
| Oracle Linux · 7 | docker-devel | 0:1.6.1-1.0.1.el7 |
| Oracle Linux · 7 | docker-logrotate | 0:1.6.1-1.0.1.el7 |
| Oracle Linux · 7 | docker-pkg-devel | 0:1.6.1-1.0.1.el7 |
| Oracle Linux · 7 | docker-vim | 0:1.6.1-1.0.1.el7 |
| Oracle Linux · 7 | docker-zsh-completion | 0:1.6.1-1.0.1.el7 |
Vulnerabilities 3
-
High 8.4
Arbitrary File Write in Libcontainer
Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
-
High 8.4
Information Exposure in Docker Engine
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a cr…
-
Medium —
Symlink Attack in Libcontainer and Docker Engine
Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.