Vulnerability in Docker
CVE-2018-15664
In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).
Vulnerability class: Race Condition
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.034 (88.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 88.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.034 · newest: 0.034 · change: 0.000
Affected products
- Docker — versions 17.06.0-ce, 17.06.1-ce, 17.06.2-ce
Weakness classification (CWE)
Public proof-of-concept exploits
References
- bugzilla.suse.com/show_bug.cgi (Exploit, Third Party Advisory, Issue Tracking)
- github.com/moby/moby/pull/39252 (Third Party Advisory, Issue Tracking)
- www.openwall.com/lists/oss-security/2019/05/28/1 (mailing-list, Exploit, Mailing List, Third Party Advisory)
- www.securityfocus.com/bid/108507 (VDB Entry, Third Party Advisory, vdb-entry)
- lists.opensuse.org/opensuse-security-announce/2019-06/msg00066.html (vendor-advisory)
- usn.ubuntu.com/4048-1/ (vendor-advisory)
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-15664
- access.redhat.com/errata/RHSA-2019:1910 (vendor-advisory)
- www.openwall.com/lists/oss-security/2019/08/21/1 (mailing-list)
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html (vendor-advisory)
Frequently asked questions
- What is CVE-2018-15664?
- CVE-2018-15664 is a high-severity vulnerability in Docker, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 7.5/10. Published 2019-05-23.
- How severe is CVE-2018-15664?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2018-15664 known to be exploited?
- 13 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.