CVE-2018-15664 Path traversal in n/a
Attackers can exploit symlink exchange in docker cp to achieve arbitrary read-write access to the host filesystem with root privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-15664?
CVE-2018-15664 is a high-severity path traversal vulnerability in n/a, published on 23 May 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).
Weakness: CWE-362
Which versions are affected by CVE-2018-15664?
It affects 1 product.
Linux distribution packages (14)
docker Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-102.git7f2769b.el7 |
docker-client Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-102.git7f2769b.el7 |
docker-common Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-102.git7f2769b.el7 |
docker-debuginfo Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-102.git7f2769b.el7 |
docker-logrotate Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-102.git7f2769b.el7 |
docker-lvm-plugin Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-102.git7f2769b.el7 |
docker-novolume-plugin Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-102.git7f2769b.el7 |
docker-rhel-push-plugin Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-102.git7f2769b.el7 |
docker-v1.10-migrator Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-102.git7f2769b.el7 |
docker SUSE:Linux Enterprise Module for Containers 12 | All versions | 18.09.6_ce-98.40.1 |
docker SUSE:Linux Enterprise Module for Containers 15 | All versions | 18.09.6_ce-6.20.3 |
docker SUSE:Linux Enterprise Module for Containers 15 SP1 | All versions | 18.09.6_ce-6.20.3 |
docker openSUSE:Leap 15.0 | All versions | 18.09.6_ce-lp151.2.6.1 |
docker openSUSE:Leap 15.1 | All versions | 18.09.6_ce-lp151.2.6.1 |
Products include Docker Docker.
How do I fix CVE-2018-15664?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-15664 being exploited?
There is no known exploitation of CVE-2018-15664 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as CLEANSTART-2026-FG82255, DEBIAN-CVE-2018-15664, GHSA-pv79-5r2c-jrpq, RHSA-2019:1910, SUSE-SU-2019:1514-1, SUSE-SU-2019:1562-1 and 2 more.