Vulnerabilities > CVE-2018-15664 - Race Condition vulnerability in Docker
Attack vector
LOCAL Attack complexity
HIGH Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Leveraging Race Conditions This attack targets a race condition occurring when multiple processes access and manipulate the same resource concurrently and the outcome of the execution depends on the particular order in which the access takes place. The attacker can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance a race condition can occur while accessing a file, the attacker can trick the system by replacing the original file with his version and cause the system to read the malicious file.
- Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. The typical example is the file access. The attacker can leverage a file access race condition by "running the race", meaning that he would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the attacker could do something such as replace the file and cause an escalation of privilege.
Nessus
NASL family PhotonOS Local Security Checks NASL id PHOTONOS_PHSA-2019-1_0-0238_DOCKER.NASL description An update of the docker package has been released. last seen 2020-06-01 modified 2020-06-02 plugin id 126190 published 2019-06-25 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/126190 title Photon OS 1.0: Docker PHSA-2019-1.0-0238 NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-4048-1.NASL description Aleksa Sarai discovered that Docker was vulnerable to a directory traversal attack. An attacker could use this vulnerability to read and write arbitrary files on the host filesystem as root. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 126564 published 2019-07-09 reporter Ubuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/126564 title Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : Docker vulnerabilities (USN-4048-1) NASL family PhotonOS Local Security Checks NASL id PHOTONOS_PHSA-2019-3_0-0019_GO.NASL description An update of the go package has been released. last seen 2020-06-01 modified 2020-06-02 plugin id 126193 published 2019-06-25 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/126193 title Photon OS 3.0: Go PHSA-2019-3.0-0019 NASL family SuSE Local Security Checks NASL id SUSE_SU-2019-2223-1.NASL description This is a version update for podman to version 1.4.4 (bsc#1143386). Additional changes by SUSE on top : Remove fuse-overlayfs because it last seen 2020-06-01 modified 2020-06-02 plugin id 128302 published 2019-08-28 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/128302 title SUSE SLES15 Security Update : podman, slirp4netns / libcontainers-common (SUSE-SU-2019:2223-1) NASL family PhotonOS Local Security Checks NASL id PHOTONOS_PHSA-2019-3_0-0019_BUBBLEWRAP.NASL description An update of the bubblewrap package has been released. last seen 2020-06-01 modified 2020-06-02 plugin id 126191 published 2019-06-25 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/126191 title Photon OS 3.0: Bubblewrap PHSA-2019-3.0-0019 NASL family SuSE Local Security Checks NASL id OPENSUSE-2019-1621.NASL description This update for docker fixes the following issues : Security issue fixed: 	 - CVE-2018-15664: Fixed an issue which could make docker cp vulnerable to symlink-exchange race attacks (bsc#1096726). This update was imported from the SUSE:SLE-15:Update update project. last seen 2020-06-01 modified 2020-06-02 plugin id 126236 published 2019-06-25 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/126236 title openSUSE Security Update : docker (openSUSE-2019-1621) NASL family SuSE Local Security Checks NASL id OPENSUSE-2019-2044.NASL description This is a version update for podman to version 1.4.4 (bsc#1143386). Additional changes by SUSE on top : - Remove fuse-overlayfs because it last seen 2020-06-01 modified 2020-06-02 plugin id 128458 published 2019-09-03 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/128458 title openSUSE Security Update : podman / slirp4netns and libcontainers-common (openSUSE-2019-2044) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2019-4680.NASL description Description of changes: docker-engine [ 18.09.1-1.0.8] - cherry-picked fix for CVE-2018-15664 from upstream [18.09.1-1.0.7] - added runc version requirement [18.09.1-1.0.6] - disable kmem accounting for UEKR4 docker-cli [ 18.09.1-1.0.8] - rebuild [18.09.1-1.0.7] - rebuild [18.09.1-1.0.6] - disable kmem accounting for UEKR4 runc [1.0.0-19.rc5.git4bb1fe4.0.4.el7] - fixing version (Michael Calunod) - adding nokem to buildargs in spec file. (Michael Calunod) - cgroups: nokmem: error out on explicitly-set kmemcg limits (Aleksa Sarai) - libcontainer: ability to compile without kmem (Kir Kolyshkin) last seen 2020-06-01 modified 2020-06-02 plugin id 125938 published 2019-06-17 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125938 title Oracle Linux 7 : docker-engine (ELSA-2019-4680) NASL family Amazon Linux Local Security Checks NASL id ALA_ALAS-2019-1245.NASL description A flaw was discovered in the API endpoint behind the last seen 2020-06-01 modified 2020-06-02 plugin id 127073 published 2019-07-26 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/127073 title Amazon Linux AMI : docker (ALAS-2019-1245) NASL family PhotonOS Local Security Checks NASL id PHOTONOS_PHSA-2019-2_0-0162_DOCKER.NASL description An update of the docker package has been released. last seen 2020-06-01 modified 2020-06-02 plugin id 126209 published 2019-06-25 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/126209 title Photon OS 2.0: Docker PHSA-2019-2.0-0162 NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2019-1910.NASL description An update for docker is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Docker is an open source engine that automates the deployment of any application as a lightweight, portable, self-sufficient container that runs virtually anywhere. Security Fix(es) : * docker: symlink-exchange race attacks in docker cp (CVE-2018-15664) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es) : * slowness of system shutdown when containers are being stopped - dockerd is unable to communicate with rhel-push-plugin (BZ#1714032) * journald Log() in dockerd causes nil pointer dereference when PutMessage() is called before reading msg.Source (BZ#1720363) * regression: docker cp: Rel: can last seen 2020-06-01 modified 2020-06-02 plugin id 127627 published 2019-08-12 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/127627 title RHEL 7 : docker (RHSA-2019:1910) NASL family SuSE Local Security Checks NASL id SUSE_SU-2019-1562-1.NASL description This update for docker fixes the following issues : Security issue fixed : CVE-2018-15664: Fixed an issue which could make docker cp vulnerable to symlink-exchange race attacks (bsc#1096726). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 126047 published 2019-06-19 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/126047 title SUSE SLED15 / SLES15 Security Update : docker (SUSE-SU-2019:1562-1) NASL family PhotonOS Local Security Checks NASL id PHOTONOS_PHSA-2019-3_0-0019_DOCKER.NASL description An update of the docker package has been released. last seen 2020-06-01 modified 2020-06-02 plugin id 126192 published 2019-06-25 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/126192 title Photon OS 3.0: Docker PHSA-2019-3.0-0019
Redhat
advisories |
| ||||
rpms |
|
References
- https://access.redhat.com/security/cve/cve-2018-15664
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html
- http://www.openwall.com/lists/oss-security/2019/05/28/1
- http://www.openwall.com/lists/oss-security/2019/05/28/1
- http://www.openwall.com/lists/oss-security/2019/08/21/1
- http://www.openwall.com/lists/oss-security/2019/08/21/1
- http://www.securityfocus.com/bid/108507
- http://www.securityfocus.com/bid/108507
- https://access.redhat.com/errata/RHSA-2019:1910
- https://access.redhat.com/errata/RHSA-2019:1910
- https://bugzilla.suse.com/show_bug.cgi?id=1096726
- https://bugzilla.suse.com/show_bug.cgi?id=1096726
- https://github.com/moby/moby/pull/39252
- https://github.com/moby/moby/pull/39252
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-15664
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-15664
- https://usn.ubuntu.com/4048-1/
- https://usn.ubuntu.com/4048-1/