CVE-2016-8867 Privilege escalation in n/a
Malicious Docker images can bypass user permissions to access container files or mounted volumes due to misconfigured ambient capabilities.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-8867?
CVE-2016-8867 is a high-severity vulnerability in n/a, published on 28 Oct 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
Weakness: CWE-264
Which versions are affected by CVE-2016-8867?
It affects 1 product.
Linux distribution packages (8)
containerd SUSE:Linux Enterprise Module for Containers 12 | All versions | 0.2.4+gitr565_0366d7e-9.1 |
docker SUSE:Linux Enterprise Module for Containers 12 | All versions | 1.12.3-81.2 |
rubygem-docker-api SUSE:Linux Enterprise Module for Containers 12 | All versions | 1.31.0-11.2 |
rubygem-excon SUSE:Linux Enterprise Module for Containers 12 | All versions | 0.52.0-9.1 |
runc SUSE:Linux Enterprise Module for Containers 12 | All versions | 0.1.1+gitr2816_02f8fa7-9.1 |
containerd SUSE:OpenStack Cloud 6 | All versions | 0.2.4+gitr565_0366d7e-9.1 |
docker SUSE:OpenStack Cloud 6 | All versions | 1.12.3-81.2 |
runc SUSE:OpenStack Cloud 6 | All versions | 0.1.1+gitr2816_02f8fa7-9.1 |
Products include Docker Docker.
How do I fix CVE-2016-8867?
Apply the vendor's patch.
Is CVE-2016-8867 being exploited?
There is no known exploitation of CVE-2016-8867 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as SUSE-SU-2016:3084-1.