CVE-2026-41568

Отчет

This flaw is rated as Low impact. A race condition in the docker cp mount setup within the Moby container framework allows a malicious container to create empty files or directories at arbitrary locations on the host filesystem. Successful exploitation is difficult (AC:H) due to the timing-dependent nature of the race condition. Containers that do not have volume mounts are not affected, as the race occurs during volume bind-mount setup. Denial of Service is possible by:

• Converting /etc/docker/daemon.json into a directory prevents the daemon from restarting
• Creating /etc/nologin prevents user logins
• Overwriting critical system paths with empty files can break host services The container does not gain read or write access to existing host files — only the ability to create new empty files or directories at chosen paths.

Меры по смягчению последствий

Avoid using docker cp with untrusted running containers. Recommended to apply patches: Mountpoint creation is now scoped to the container root using os.Root (Go 1.24+), which refuses to follow symlinks that escape the opened root directory. All filesystem operations in createIfNotExists (MkdirAll, OpenFile) are performed through the os.Root handle, so even if a symlink swap occurs after path resolution, the creation stays confined to the container root.