Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.

The Linux container runtime environment Docker was updated to version 1.6.2 to fix several security and non-security issues.

  - Security :

  - Fix read/write /proc paths. (CVE-2015-3630)

  - Prohibit VOLUME /proc and VOLUME /. (CVE-2015-3631)

  - Fix opening of file-descriptor 1. (CVE-2015-3627)

  - Fix symlink traversal on container respawn allowing     local privilege escalation. (CVE-2015-3629)

  - Runtime :

  - Update Apparmor policy to not allow mounts.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3037 advisory.

    [1.6.1-1.0.1]
    - Update source to 1.6.1 from https://github.com/docker/docker/releases/tag/v1.6.1       Symlink traversal on container respawn allows local privilege escalation (CVE-2015-3629)       Insecure opening of file-descriptor 1 leading to privilege escalation (CVE-2015-3627)       Read/write proc paths allow host modification & information disclosure (CVE-2015-3630)       Volume mounts allow LSM profile escalation (CVE-2015-3631)       AppArmor policy improvements

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

docker was updated to version 1.6.1 to fix several security and non-security issues. 

  - Updated to version 1.6.1 (2015-05-07) [bnc#930235]

  - Security

  - Fix read/write /proc paths (CVE-2015-3630)

  - Prohibit VOLUME /proc and VOLUME / (CVE-2015-3631)

  - Fix opening of file-descriptor 1 (CVE-2015-3627)

  - Fix symlink traversal on container respawn allowing     local privilege escalation (CVE-2015-3629)

  - Prohibit mount of /sys

  - Runtime

  - Update Apparmor policy to not allow mounts

  - Updated libcontainer-apparmor-fixes.patch: adapt patch     to reflect changes introduced by docker 1.6.1

The file-descriptor passed by libcontainer to the pid-1 process of a container has been found to be opened prior to performing the chroot, allowing insecure open and symlink traversal. This allows malicious container images to trigger a local privilege escalation.
(CVE-2015-3627)

Libcontainer version 1.6.0 introduced changes which facilitated a mount namespace breakout upon respawn of a container. This allowed malicious images to write files to the host system and escape containerization. (CVE-2015-3629)

Several paths underneath /proc were writable from containers, allowing global system manipulation and configuration. These paths included /proc/asound, /proc/timer_stats, /proc/latency_stats, and /proc/fs. By allowing writes to /proc/fs, it has been noted that CIFS volumes could be forced into a protocol downgrade attack by a root user operating inside of a container. Machines having loaded the timer_stats module were vulnerable to having this mechanism enabled and consumed by a container. (CVE-2015-3630)

By allowing volumes to override files of /proc within a mount namespace, a user could specify arbitrary policies for Linux Security Modules, including setting an unconfined policy underneath AppArmor, or a docker_t policy for processes managed by SELinux. In all versions of Docker up until 1.6.1, it is possible for malicious images to configure volume mounts such that files of proc may be overridden.
(CVE-2015-3631)

ID	Name	Product	Family	Severity
83970	SUSE SLES12 Security Update : docker (SUSE-SU-2015:0984-1)	Nessus	SuSE Local Security Checks	high
83776	Oracle Linux 6 / 7 : docker (ELSA-2015-3037)	Nessus	Oracle Linux Local Security Checks	high
83557	openSUSE Security Update : docker (openSUSE-2015-365)	Nessus	SuSE Local Security Checks	high
83280	Amazon Linux AMI : docker (ALAS-2015-522)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2015-3630

high

Tenable Plugins

high

high

high

high