CVE-2015-3629

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-3629
Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html Mailing List Third Party Advisory
http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2015/May/28 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/74558 Broken Link Third Party Advisory VDB Entry
https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ Permissions Required
Configurations

Configuration 1 (hide)

cpe:2.3:a:docker:libcontainer:1.6.0:*:*:*:*:docker:*:*

Configuration 2 (hide)

cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
History

02 Feb 2024, 02:07

Type Values Removed Values Added
First Time Opensuse opensuse
Opensuse
CPE cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
CVSS v2 : 7.2
v3 : unknown 		v2 : 7.2
v3 : 7.8
References () http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html - () http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html - Mailing List, Third Party Advisory
References () http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html - () http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html - Third Party Advisory, VDB Entry
References () http://seclists.org/fulldisclosure/2015/May/28 - () http://seclists.org/fulldisclosure/2015/May/28 - Mailing List, Third Party Advisory
References () http://www.securityfocus.com/bid/74558 - () http://www.securityfocus.com/bid/74558 - Broken Link, Third Party Advisory, VDB Entry
References () https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ - () https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ - Permissions Required

07 Nov 2023, 02:25

Type Values Removed Values Added
References
  • {'url': 'https://groups.google.com/forum/#!searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ', 'name': 'https://groups.google.com/forum/#!searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ', 'tags': [], 'refsource': 'CONFIRM'}
  • () https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ -
Information

Published : 2015-05-18 15:59

Updated : 2024-02-02 02:07

NVD link : CVE-2015-3629

Mitre link : CVE-2015-3629

CVE.ORG link : CVE-2015-3629

JSON object : View

Products Affected

docker

  • libcontainer

opensuse

  • opensuse
CWE
CWE-59

Improper Link Resolution Before File Access ('Link Following')