CVE-2017-16539 in Docker Moby
Summary
by MITRE
The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 01/27/2026
The vulnerability identified as CVE-2017-16539 resides within Docker Moby's DefaultLinuxSpec function, specifically in the oci/defaults.go file, affecting versions through 17.03.2-ce. This flaw represents a significant security oversight in container runtime configuration that enables unauthorized data loss through improper path access control. The vulnerability manifests when Docker containers are granted access to the /proc/scsi path, which should be restricted to prevent malicious exploitation. The issue stems from the function's failure to properly block access to specific SCSI-related paths within the /proc filesystem, creating an attack vector that can be leveraged by privileged container processes.
The technical exploitation of this vulnerability occurs through the manipulation of the /proc/scsi/scsi file, which serves as an interface for SCSI device management in Linux kernels. When attackers write a "scsi remove-single-device" command to this specific file path, they can trigger a cascade of events that leads to data loss, particularly when operating with older Linux kernel versions that are more susceptible to this particular exploitation technique. This vulnerability operates under CWE-269, which addresses privilege escalation issues, and specifically relates to improper restriction of operations within a security domain. The attack leverages the container's ability to interact with kernel-level interfaces, bypassing normal filesystem access controls that should prevent such operations.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it enables attackers to cause deliberate data loss through the manipulation of SCSI subsystems. When exploited, the vulnerability can result in the removal of legitimate SCSI devices from the system, potentially leading to complete data loss or system instability, particularly in environments where critical storage systems are managed through SCSI interfaces. The vulnerability is particularly dangerous in containerized environments where containers might be granted broader access than necessary, as it allows for direct manipulation of hardware-level interfaces through the container's elevated privileges. This represents a critical failure in the principle of least privilege and demonstrates how container security configurations can inadvertently expose systems to hardware-level attacks.
Mitigation strategies for CVE-2017-16539 should focus on implementing comprehensive path access controls within Docker container configurations, specifically ensuring that /proc/scsi and related paths are properly restricted from container access. Organizations should upgrade to Docker Moby versions that have addressed this vulnerability through proper path filtering in the DefaultLinuxSpec function. The implementation of runtime security controls such as Docker's built-in security policies, kernel capabilities restrictions, and proper container isolation techniques can help prevent unauthorized access to sensitive system interfaces. Additionally, implementing network segmentation and monitoring for unusual /proc filesystem access patterns can provide early detection of potential exploitation attempts. This vulnerability aligns with ATT&CK technique T1055, which covers privilege escalation through kernel manipulation, and demonstrates the importance of proper container runtime security configurations in preventing low-level system interface exploitation.