Bug 1172761 (CVE-2014-9356) - CVE-2014-9356 docker: Path traversal during processing of absolute symlinks
Summary: CVE-2014-9356 docker: Path traversal during processing of absolute symlinks
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-9356
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1173324 1173325
Blocks: 1198578
TreeView+ depends on / blocked
 
Reported: 2014-12-10 17:03 UTC by Trevor Jay
Modified: 2023-05-12 19:48 UTC (History)
11 users (show)

Fixed In Version: docker 1.3.3
Doc Type: Bug Fix
Doc Text:
It was found that a malicious container image could overwrite arbitrary portions of the host file system by including absolute symlinks, potentially leading to privilege escalation.
Clone Of:
Environment:
Last Closed: 2021-10-20 10:48:17 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:0623 0 normal SHIPPED_LIVE Low: docker security, bug fix, and enhancement update 2015-03-05 15:28:35 UTC

Description Trevor Jay 2014-12-10 17:03:41 UTC 
A problem was reported by Docker Inc. whereby a malicious image could overwrite arbitrary portions of the host filesystem by including absolute symlinks. From the upstream report:

"Path traversal attacks are possible in the processing of absolute symlinks. In checking symlinks for traversals, only relative links were considered. This allowed path traversals to exist where they should have otherwise been prevented. This was exploitable via both archive extraction and through volume mounts.

This vulnerability allowed malicious images or builds from malicious Dockerfiles to write files to the host system and escape containerization, leading to privilege escalation."
Comment 1 Trevor Jay 2014-12-10 17:24:46 UTC 
Statement:

This issue affects the versions of Docker as shipped with Red Hat Enterprise Linux 7. However, this flaw is not known to be exploitable under any supported scenario. A future update may address this issue.

Red Hat does not support or recommend running untrusted images.
Comment 2 Vincent Danen 2014-12-11 20:50:37 UTC 
External References:

https://groups.google.com/forum/#!topic/docker-user/nFAz-B-n4Bw
Comment 3 Vincent Danen 2014-12-11 21:01:59 UTC 
Created docker-io tracking bugs for this issue:

Affects: fedora-all [bug 1173324]
Affects: epel-6 [bug 1173325]
Comment 4 Trevor Jay 2014-12-12 01:59:14 UTC 
Acknowledgements:

Red Hat would like to thank Docker Inc. for reporting this issue.
Comment 5 Fedora Update System 2014-12-15 04:32:41 UTC 
docker-io-1.4.0-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2015-01-26 02:35:26 UTC 
docker-io-1.4.1-6.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2015-01-31 16:53:19 UTC 
docker-io-1.4.1-3.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.