Bug 1172761 (CVE-2014-9356)

Summary:	CVE-2014-9356 docker: Path traversal during processing of absolute symlinks
Product:	[Other] Security Response	Reporter:	Trevor Jay <tjay>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	dbecker, dwalsh, jjoyce, jschluet, lhh, lpeer, mburns, rhos-maint, sclewis, security-response-team, slinaber
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	docker 1.3.3	Doc Type:	Bug Fix
Doc Text:	It was found that a malicious container image could overwrite arbitrary portions of the host file system by including absolute symlinks, potentially leading to privilege escalation.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-20 10:48:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1173324, 1173325
Bug Blocks:	1198578

Description Trevor Jay 2014-12-10 17:03:41 UTC

A problem was reported by Docker Inc. whereby a malicious image could overwrite arbitrary portions of the host filesystem by including absolute symlinks. From the upstream report:

"Path traversal attacks are possible in the processing of absolute symlinks. In checking symlinks for traversals, only relative links were considered. This allowed path traversals to exist where they should have otherwise been prevented. This was exploitable via both archive extraction and through volume mounts.

This vulnerability allowed malicious images or builds from malicious Dockerfiles to write files to the host system and escape containerization, leading to privilege escalation."

Comment 1 Trevor Jay 2014-12-10 17:24:46 UTC

Statement:

This issue affects the versions of Docker as shipped with Red Hat Enterprise Linux 7. However, this flaw is not known to be exploitable under any supported scenario. A future update may address this issue.

Red Hat does not support or recommend running untrusted images.

Comment 2 Vincent Danen 2014-12-11 20:50:37 UTC

External References:

https://groups.google.com/forum/#!topic/docker-user/nFAz-B-n4Bw

Comment 3 Vincent Danen 2014-12-11 21:01:59 UTC

Created docker-io tracking bugs for this issue:

Affects: fedora-all [bug 1173324]
Affects: epel-6 [bug 1173325]

Comment 4 Trevor Jay 2014-12-12 01:59:14 UTC

Acknowledgements:

Red Hat would like to thank Docker Inc. for reporting this issue.

Comment 5 Fedora Update System 2014-12-15 04:32:41 UTC

docker-io-1.4.0-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2015-01-26 02:35:26 UTC

docker-io-1.4.1-6.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2015-01-31 16:53:19 UTC

docker-io-1.4.1-3.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.