[arch-security] [ASA-201505-6] docker: multiple issues

[Levente Polyak]

Arch Linux Security Advisory ASA-201505-6
=========================================

Severity: High
Date    : 2015-05-08
CVE-ID  : CVE-2015-3627 CVE-2015-3629 CVE-2015-3630 CVE-2015-3631
Package : docker
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package docker before version 1:1.6.1-1 is vulnerable to multiple
issues including but not limited to privilege escalation, symlink
traversal, unauthorized configuration modification, information
disclosure and policy profile escalation.

Resolution
==========

Upgrade to 1:1.6.1-1.

# pacman -Syu "docker>=1:1.6.1-1"

The problems have been fixed upstream in version 1.6.1.

Workaround
==========

None.

Description
===========

- CVE-2015-3627 (privilege escalation)

The file-descriptor passed by libcontainer to the pid-1 process of a
container has been found to be opened prior to performing the chroot,
allowing insecure open and symlink traversal. This allows malicious
container images to trigger a local privilege escalation.

- CVE-2015-3629 (privilege escalation)

Symlink traversal on container respawn allows local privilege
escalation. Libcontainer version 1.6.0 introduced changes which
facilitated a mount namespace breakout upon respawn of a container. This
allowed malicious images to write files to the host system and escape
containerization.

- CVE-2015-3630 (unauthorized modification)

Several paths underneath /proc were writable from containers, allowing
global system manipulation and configuration. These paths included
/proc/asound, /proc/timer_stats, /proc/latency_stats, and /proc/fs.
By allowing writes to /proc/fs, it has been noted that CIFS volumes
could be forced into a protocol downgrade attack by a root user
operating inside of a container. Machines having loaded the timer_stats
module were vulnerable to having this mechanism enabled and consumed by
a container.

- CVE-2015-3631 (policy profile escalation)

By allowing volumes to override files of /proc within a mount namespace,
a user could specify arbitrary policies for Linux Security Modules,
including setting an unconfined policy underneath AppArmor, or a
docker_t policy for processes managed by SELinux. In all versions of
Docker up until 1.6.1, it is possible for malicious images to configure
volume mounts such that files of proc may be overridden.

Impact
======

A remote attacker is able to escalate privileges via unsafe symlink
traversal, modify the configuration of the host system or disclose
information via specific writable descriptors in /proc or escalate the
LSM policy profiles by overriding files of /proc.

References
==========

http://seclists.org/oss-sec/2015/q2/389
https://access.redhat.com/security/cve/CVE-2015-3627
https://access.redhat.com/security/cve/CVE-2015-3629
https://access.redhat.com/security/cve/CVE-2015-3630
https://access.redhat.com/security/cve/CVE-2015-3631

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20150508/805d5921/attachment.asc>