The following flaw was reported in Docker: Several paths underneath /proc were writable from containers, allowing global system manipulation and configuration. These paths included /proc/asound, /proc/timer_stats, /proc/latency_stats, and /proc/fs. By allowing writes to /proc/fs, it has been noted that CIFS volumes could be forced into a protocol downgrade attack by a root user operating inside of a container. Machines having loaded the timer_stats module were vulnerable to having this mechanism enabled and consumed by a container. Docker Engine 1.6.1 address this vulnerability. Acknowledgements: Red Hat would like to thank Eric Windisch of the Docker project for reporting this issue.
This issue is exploitable by malicious Docker images. Red Hat supports images from it's own registry, ISV images certified by the Red Hat certification program, and images using qualified customer content.
Created docker-io tracking bugs for this issue: Affects: fedora-all [bug 1219711] Affects: epel-6 [bug 1219712]