Docker Bug Allows Root Access to Host File System

guest · May 29, 2019

Docker Bug Allows Root Access to Host File System
May 28, 2019
https://duo.com/decipher/docker-bug-allows-root-access-to-host-file-system

All of the current versions of Docker have a vulnerability that can allow an attacker to get read-write access to any path on the host server. The weakness is the result of a race condition in the Docker software and while there’s a fix in the works, it has not yet been integrated.

The bug is the result of the way that the Docker software handles some symbolic links, which are files that have paths to other directories or files. Researcher Aleksa Sarai discovered that in some situations, an attacker can insert his own symlink into a path during a short time window between the time that the path has been resolved and the time it is operated on. [...] his advisory on the problem.

Kelly Shortridge, vice pesident of product development at Capsule8, a security firm that specializes in container security, said the Docker vulnerability, while serious, is not necessarily an emergency for most enterprises.
"[...] Docker users leveraging docker cp are vulnerable -- but only for sufficiently motivated attackers who are willing to enter the race against docker cp," she said.
Click to expand...

"Since there has been some suspicion that an attack like this might work for a while they felt it was okay to publish the attack publicly."
Click to expand...

Log in or Sign up

Docker Bug Allows Root Access to Host File System

guest Guest

Log in or Sign up

Docker Bug Allows Root Access to Host File System

guest Guest

Useful Searches