Описание
Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| docker.io | not-affected | package | ||
| runc | not-affected | package |
Примечания
https://github.com/docker/docker/issues/27590
docker: https://github.com/docker/docker/pull/27610/commits/d60a3418d0268745dff38947bc8c929fbd24f837 (1.12.3)
runc: https://github.com/opencontainers/runc/commit/a83f5bac28554fa0fd49bc1559a3c79f5907348f
docker.io not directly affected but will need to be updated to include new runc version
runc: "ambient capabilities" functionality added upstream with https://github.com/opencontainers/runc/pull/1086
and later changes.
The actual fix seem to be to revert the commit which introduced ambient capabilities
in runc.
Связанные уязвимости
Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
