Docker Race Condition Vulnerability Leads to Host Filesystem Access

On May 28 2019, security researcher Dennis Fisher released a blog post detailing a vulnerability in Docker that allows attackers to get read and write access to any path on the host Docker server. The CVE issue number is CVE-2018-15664, which addresses this specific vulnerability in Linux. The vulnerability is the result of a race condition in how the Docker software handles symbolic links on the container filesystem. The race condition falls under a class of problems called time of check to time of use (TOCTOU).

Recommendations

• Upgrade Docker as soon as the company releases a fix for the CVE
• Consider updating the Cyber Attack Chatter rule to listen for chatter of CVE-2018-15664 being used in the wild

Details

The function call FollowSylinkInScope is the vulnerable function. The function is supposed to take a given path and safely resolve it within the container. If the attacker can add a symlink component after the path resolution but before it is operated on, then the attacker can resolve a path on the host machine, breaking out of the container. The researcher who found the bug, Aleksa Sarai, coordinated with the Docker security team, and the two parties agreed to release the vulnerability before the fix in order for the public to adjust their security postures as needed.