Docker up to 18.06.1-ce-rc2 API Endpoint daemon/archive.go race condition

Summaryinfo

A vulnerability was found in Docker up to 18.06.1-ce-rc2. It has been rated as critical. This affects an unknown part of the file daemon/archive.go of the component API Endpoint. The manipulation leads to race condition. This vulnerability is documented as CVE-2018-15664. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Docker up to 18.06.1-ce-rc2 (Virtualization Software) and classified as very critical. This issue affects an unknown function of the file daemon/archive.go of the component API Endpoint. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).

The weakness was released 05/23/2019 as confirmed mailinglist post (oss-sec). The advisory is shared at seclists.org. The identification of this vulnerability is CVE-2018-15664 since 08/21/2018. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 09/24/2023). It is expected to see the exploit prices for this product increasing in the near future.

We expect the 0-day to have been worth approximately $25k-$100k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 158000 (Oracle Enterprise Linux Security Update for docker-engine (ELSA-2019-4680)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entry connected to this vulnerability is available at VDB-137530. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Virtualization Software

Name

• Docker

Version

• 18.06.1-ce-rc1
• 18.06.1-ce-rc2

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion