CVE-2015-3630 Information Exposure in Docker Engine

What is CVE-2015-3630?

CVE-2015-3630 is a high-severity missing authorization vulnerability in n/a, published on 18 May 2015. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.

Weakness: CWE-264

Which versions are affected by CVE-2015-3630?

3 open source packages ship an affected version, including github.com/docker/docker. It affects 1 product.

Products include Docker Docker.

How do I fix CVE-2015-3630?

Upgrade github.com/docker/docker to 1.6.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2015-3630 being exploited?

There is no known exploitation of CVE-2015-3630 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2014-9357 Arbitrary Code Execution Critical 10.0
• CVE-2020-14298 Privilege escalation in Docker High 8.8
• CVE-2020-14300 Privilege escalation in Docker High 8.8
• CVE-2018-15514 Deserialization in n/a High 8.8
• CVE-2014-9356 Path Traversal in Docker High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2015-3630, GHSA-8fvr-5rqf-3wwh, GO-2022-0638, UBUNTU-CVE-2015-3630.