Описание
The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | ignored | end of life |
| bionic | released | 18.06.1-0ubuntu1~18.04.1 |
| cosmic | released | 18.06.1-0ubuntu1 |
| devel | released | 18.06.1-0ubuntu2 |
| esm-apps/bionic | released | 18.06.1-0ubuntu1~18.04.1 |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was not-affected [code not present]] |
| esm-infra/xenial | released | 18.06.1-0ubuntu1~16.04.2 |
| precise/esm | DNE | |
| trusty | not-affected | code not present |
| trusty/esm | DNE | trusty was not-affected [code not present] |
Показывать по
EPSS
4.3 Medium
CVSS2
5.9 Medium
CVSS3
Связанные уязвимости
The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.
The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.
The DefaultLinuxSpec function in oci/defaults.go in Docker Moby throug ...
Docker Moby /proc/scsi Path Exposure Allows Host Data Loss (SCSI MICDROP)
Security update for docker, docker-runc, containerd, golang-github-docker-libnetwork
EPSS
4.3 Medium
CVSS2
5.9 Medium
CVSS3