Upstream information

CVE-2015-3630 at MITRE

Description

Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 7.2
Vector AV:L/AC:L/Au:N/C:C/I:C/A:C
Access Vector Local
Access Complexity Low
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
SUSE Bugzilla entries: 930235 [RESOLVED], 945060 [RESOLVED / DUPLICATE]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Module for Containers 12
  • docker >= 1.6.2-31.2
Patchnames:
SUSE Linux Enterprise Module for Containers 12 GA docker
SUSE Linux Enterprise Module for Containers 15
  • docker >= 17.09.1_ce-4.25
  • docker-bash-completion >= 17.09.1_ce-4.25
Patchnames:
SUSE Linux Enterprise Module for Containers 15 GA docker
SUSE Linux Enterprise Server 12
  • docker >= 1.6.2-31.2
Patchnames:
SUSE-SLE-SERVER-12-2015-230
SUSE Linux Enterprise Server for SAP Applications 12
  • docker >= 1.6.2-31.2
Patchnames:
SUSE-SLE-SERVER-12-2015-230
SUSE OpenStack Cloud 6
  • docker >= 1.9.1-58.1
Patchnames:
SUSE OpenStack Cloud 6 GA docker
openSUSE Tumbleweed
  • docker >= 1.12.3-4.1
  • docker-bash-completion >= 1.12.3-4.1
  • docker-test >= 1.12.3-4.1
  • docker-zsh-completion >= 1.12.3-4.1
Patchnames:
openSUSE Tumbleweed GA docker