CVE-2015-3627

Name of the Vulnerable Software and Affected Versions Docker Engine versions prior to 1.6.1 Libcontainer versions prior to 1.6.1

Description The issue allows local users to gain privileges via a symlink attack in an image. This occurs because Libcontainer and Docker Engine open the file-descriptor passed to the pid-1 process before performing the chroot.

Recommendations For Docker Engine versions prior to 1.6.1, update to version 1.6.1 or later to resolve the issue. For Libcontainer versions prior to 1.6.1, update to version 1.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the pid-1 process to minimize the risk of exploitation.