Vulnerabilities > CVE-2018-15664 - Race Condition vulnerability in Docker

047910
CVSS 6.2 - MEDIUM
Attack vector
LOCAL
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
local
high complexity
docker
CWE-362
nessus

Summary

In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Leveraging Race Conditions
    This attack targets a race condition occurring when multiple processes access and manipulate the same resource concurrently and the outcome of the execution depends on the particular order in which the access takes place. The attacker can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance a race condition can occur while accessing a file, the attacker can trick the system by replacing the original file with his version and cause the system to read the malicious file.
  • Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
    This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. The typical example is the file access. The attacker can leverage a file access race condition by "running the race", meaning that he would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the attacker could do something such as replace the file and cause an escalation of privilege.

Nessus

  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2019-1_0-0238_DOCKER.NASL
    descriptionAn update of the docker package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id126190
    published2019-06-25
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126190
    titlePhoton OS 1.0: Docker PHSA-2019-1.0-0238
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4048-1.NASL
    descriptionAleksa Sarai discovered that Docker was vulnerable to a directory traversal attack. An attacker could use this vulnerability to read and write arbitrary files on the host filesystem as root. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id126564
    published2019-07-09
    reporterUbuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126564
    titleUbuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : Docker vulnerabilities (USN-4048-1)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2019-3_0-0019_GO.NASL
    descriptionAn update of the go package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id126193
    published2019-06-25
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126193
    titlePhoton OS 3.0: Go PHSA-2019-3.0-0019
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-2223-1.NASL
    descriptionThis is a version update for podman to version 1.4.4 (bsc#1143386). Additional changes by SUSE on top : Remove fuse-overlayfs because it
    last seen2020-06-01
    modified2020-06-02
    plugin id128302
    published2019-08-28
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128302
    titleSUSE SLES15 Security Update : podman, slirp4netns / libcontainers-common (SUSE-SU-2019:2223-1)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2019-3_0-0019_BUBBLEWRAP.NASL
    descriptionAn update of the bubblewrap package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id126191
    published2019-06-25
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126191
    titlePhoton OS 3.0: Bubblewrap PHSA-2019-3.0-0019
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1621.NASL
    descriptionThis update for docker fixes the following issues : Security issue fixed: 	 - CVE-2018-15664: Fixed an issue which could make docker cp vulnerable to symlink-exchange race attacks (bsc#1096726). This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id126236
    published2019-06-25
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126236
    titleopenSUSE Security Update : docker (openSUSE-2019-1621)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2044.NASL
    descriptionThis is a version update for podman to version 1.4.4 (bsc#1143386). Additional changes by SUSE on top : - Remove fuse-overlayfs because it
    last seen2020-06-01
    modified2020-06-02
    plugin id128458
    published2019-09-03
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128458
    titleopenSUSE Security Update : podman / slirp4netns and libcontainers-common (openSUSE-2019-2044)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2019-4680.NASL
    descriptionDescription of changes: docker-engine [ 18.09.1-1.0.8] - cherry-picked fix for CVE-2018-15664 from upstream [18.09.1-1.0.7] - added runc version requirement [18.09.1-1.0.6] - disable kmem accounting for UEKR4 docker-cli [ 18.09.1-1.0.8] - rebuild [18.09.1-1.0.7] - rebuild [18.09.1-1.0.6] - disable kmem accounting for UEKR4 runc [1.0.0-19.rc5.git4bb1fe4.0.4.el7] - fixing version (Michael Calunod) - adding nokem to buildargs in spec file. (Michael Calunod) - cgroups: nokmem: error out on explicitly-set kmemcg limits (Aleksa Sarai) - libcontainer: ability to compile without kmem (Kir Kolyshkin)
    last seen2020-06-01
    modified2020-06-02
    plugin id125938
    published2019-06-17
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125938
    titleOracle Linux 7 : docker-engine (ELSA-2019-4680)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2019-1245.NASL
    descriptionA flaw was discovered in the API endpoint behind the
    last seen2020-06-01
    modified2020-06-02
    plugin id127073
    published2019-07-26
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127073
    titleAmazon Linux AMI : docker (ALAS-2019-1245)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2019-2_0-0162_DOCKER.NASL
    descriptionAn update of the docker package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id126209
    published2019-06-25
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126209
    titlePhoton OS 2.0: Docker PHSA-2019-2.0-0162
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-1910.NASL
    descriptionAn update for docker is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Docker is an open source engine that automates the deployment of any application as a lightweight, portable, self-sufficient container that runs virtually anywhere. Security Fix(es) : * docker: symlink-exchange race attacks in docker cp (CVE-2018-15664) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es) : * slowness of system shutdown when containers are being stopped - dockerd is unable to communicate with rhel-push-plugin (BZ#1714032) * journald Log() in dockerd causes nil pointer dereference when PutMessage() is called before reading msg.Source (BZ#1720363) * regression: docker cp: Rel: can
    last seen2020-06-01
    modified2020-06-02
    plugin id127627
    published2019-08-12
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127627
    titleRHEL 7 : docker (RHSA-2019:1910)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-1562-1.NASL
    descriptionThis update for docker fixes the following issues : Security issue fixed : CVE-2018-15664: Fixed an issue which could make docker cp vulnerable to symlink-exchange race attacks (bsc#1096726). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id126047
    published2019-06-19
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126047
    titleSUSE SLED15 / SLES15 Security Update : docker (SUSE-SU-2019:1562-1)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2019-3_0-0019_DOCKER.NASL
    descriptionAn update of the docker package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id126192
    published2019-06-25
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126192
    titlePhoton OS 3.0: Docker PHSA-2019-3.0-0019

Redhat

advisories
rhsa
idRHSA-2019:1910
rpms
  • docker-2:1.13.1-102.git7f2769b.el7
  • docker-client-2:1.13.1-102.git7f2769b.el7
  • docker-common-2:1.13.1-102.git7f2769b.el7
  • docker-debuginfo-2:1.13.1-102.git7f2769b.el7
  • docker-logrotate-2:1.13.1-102.git7f2769b.el7
  • docker-lvm-plugin-2:1.13.1-102.git7f2769b.el7
  • docker-novolume-plugin-2:1.13.1-102.git7f2769b.el7
  • docker-rhel-push-plugin-2:1.13.1-102.git7f2769b.el7
  • docker-v1.10-migrator-2:1.13.1-102.git7f2769b.el7