Bug 1111687 (CVE-2014-3499)

Summary:	CVE-2014-3499 docker: systemd socket activation results in privilege escalation
Product:	[Other] Security Response	Reporter:	Jon Stanley <jonstanley>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	admiller, alexl, dwalsh, golang-updates, hushan.jia, jkeck, jon.stanley, jrusnack, lsm5, lsm5, mattdm, mgoldman, mjenner, security-response-team, sghosh, sparks, s, tjay, vbatts
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-07-01 04:42:20 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1111760, 1111769, 1114810, 1114811, 1114816
Bug Blocks:	1111739

Comment 30 Trevor Jay 2014-07-01 02:40:56 UTC

It was found that the socket used to manage the Docker service was world readable and writable. A local user could use this flaw to escalate their privileges to root.

Acknowledgements:

Red Hat would like to thank Jon Stanley for reporting this issue.

Comment 31 Trevor Jay 2014-07-01 02:44:49 UTC

This flaw also affects all Fedora 19 and 20 docker-io packages up to and including 1.0.0-4.

Comment 33 errata-xmlrpc 2014-07-01 04:05:06 UTC

This issue has been addressed in following products:

  RHEL Extras for RHEL-7

Via RHSA-2014:0820 https://rhn.redhat.com/errata/RHSA-2014-0820.html

Comment 34 Trevor Jay 2014-07-01 04:40:24 UTC

Created docker-io tracking bugs for this issue:

Affects: fedora-all [bug 1114810]
Affects: epel-6 [bug 1114811]

Comment 35 Trevor Jay 2014-07-01 05:41:02 UTC

Created docker-io tracking bugs for this issue:

Affects: epel-7 [bug 1114816]