CVE-2017-16539 Docker Moby /proc/scsi Path Exposure Allows Host Data Loss (SCSI MICDROP)

What is CVE-2017-16539?

CVE-2017-16539 is a medium-severity missing authorization vulnerability in n/a, published on 4 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.

Weakness: CWE-200

Which versions are affected by CVE-2017-16539?

2 open source packages ship an affected version, including github.com/moby/moby. It affects 1 product.

Products include Mobyproject Moby.

How do I fix CVE-2017-16539?

Upgrade github.com/moby/moby to 17.12.0-ce or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2017-16539 being exploited?

There is no known exploitation of CVE-2017-16539 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2024-36623 Moby Race Condition vulnerability High 8.1
• CVE-2023-28840 moby/moby's dockerd daemon encrypted overlay network may be unauthenticated High 7.5
• CVE-2018-12608 Docker Authentication Bypass High 7.5
• CVE-2024-24557 Moby classic builder cache poisoning Medium 6.9
• CVE-2023-28841 moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2017-16539, GHSA-vfjc-2qcw-j95j, UBUNTU-CVE-2017-16539.