Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.

The Linux container runtime environment Docker was updated to version 1.6.2 to fix several security and non-security issues.

  - Security :

  - Fix read/write /proc paths. (CVE-2015-3630)

  - Prohibit VOLUME /proc and VOLUME /. (CVE-2015-3631)

  - Fix opening of file-descriptor 1. (CVE-2015-3627)

  - Fix symlink traversal on container respawn allowing     local privilege escalation. (CVE-2015-3629)

  - Runtime :

  - Update Apparmor policy to not allow mounts.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

docker was updated to version 1.6.1 to fix several security and non-security issues. 

  - Updated to version 1.6.1 (2015-05-07) [bnc#930235]

  - Security

  - Fix read/write /proc paths (CVE-2015-3630)

  - Prohibit VOLUME /proc and VOLUME / (CVE-2015-3631)

  - Fix opening of file-descriptor 1 (CVE-2015-3627)

  - Fix symlink traversal on container respawn allowing     local privilege escalation (CVE-2015-3629)

  - Prohibit mount of /sys

  - Runtime

  - Update Apparmor policy to not allow mounts

  - Updated libcontainer-apparmor-fixes.patch: adapt patch     to reflect changes introduced by docker 1.6.1

The file-descriptor passed by libcontainer to the pid-1 process of a container has been found to be opened prior to performing the chroot, allowing insecure open and symlink traversal. This allows malicious container images to trigger a local privilege escalation.
(CVE-2015-3627)

Libcontainer version 1.6.0 introduced changes which facilitated a mount namespace breakout upon respawn of a container. This allowed malicious images to write files to the host system and escape containerization. (CVE-2015-3629)

Several paths underneath /proc were writable from containers, allowing global system manipulation and configuration. These paths included /proc/asound, /proc/timer_stats, /proc/latency_stats, and /proc/fs. By allowing writes to /proc/fs, it has been noted that CIFS volumes could be forced into a protocol downgrade attack by a root user operating inside of a container. Machines having loaded the timer_stats module were vulnerable to having this mechanism enabled and consumed by a container. (CVE-2015-3630)

By allowing volumes to override files of /proc within a mount namespace, a user could specify arbitrary policies for Linux Security Modules, including setting an unconfined policy underneath AppArmor, or a docker_t policy for processes managed by SELinux. In all versions of Docker up until 1.6.1, it is possible for malicious images to configure volume mounts such that files of proc may be overridden.
(CVE-2015-3631)

ID	Name	Product	Family	Severity
83970	SUSE SLES12 Security Update : docker (SUSE-SU-2015:0984-1)	Nessus	SuSE Local Security Checks	high
83557	openSUSE Security Update : docker (openSUSE-2015-365)	Nessus	SuSE Local Security Checks	high
83280	Amazon Linux AMI : docker (ALAS-2015-522)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2015-3631

medium

Tenable Plugins

high

high

high