Docker’s vulnerability allows reading and writing any file on the host

In Docker discovered vulnerability of parallelism uncertainty, or so called “race condition”.

With its help attacker can write and read any file on a host. Issue involves all Docker versions.

Vulnerability is similar to CVE-2018-15664 and allows attacker rewrite resource pathways after permission and before start of program’s work on this resource (TOCTOU error).

Issue affects FollowSymlinkScope function, vulnerable to base TOCTOU attack. This function is used for secure permission for path while all processes processed in a way as if they are going inside Docker container.

Permitted path is not used at once, but after a while. This occurred “window” can use attackers and add symbolic links that will be finally enabled on the host with superuser’s privileges.

Aleksa Sarai
Aleksa Sarai
As explained by Suse specialist Aleksa Sarai, this can be done with the help of the ‘docker cp’ utility, which allows copying content between the container and the file system.

“If an attacker can add a symlink component to the path *after* the resolution but *before*
it is operated on, then you could end up resolving the symlink path component on the host as root. In the case of ‘docker cp’ this gives you read *and* write access to any path on the host” , — said Aleksa Sarai.

Trying to avoid vulnerability exploitation, Sarai recommended modifing ‘chrootarchive’ in a way that archive operation would be performed in a safe environment, where superuser is ‘rootfs’ container.

Researcher also presented two scripts – one for writing and second for reading. Prior to publication of details Sarai informed Docker developers.


About Trojan Killer

Carry Trojan Killer Portable on your memory stick. Be sure that you’re able to help your PC resist any cyber threats wherever you go.

Check Also

MageCart on the Heroku Cloud Platform

Researchers Found Several MageCart Web Skimmers On Heroku Cloud Platform

Researchers at Malwarebytes reported about finding several MageCart web skimmers on the Heroku cloud platform …

Android Spyware CallerSpy

CallerSpy spyware masks as an Android chat application

Trend Micro experts discovered the malware CallerSpy, which masks as an Android chat application and, …

Leave a Reply