Vulnerability Details : CVE-2015-3630
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
Threat overview for CVE-2015-3630
Top countries where our scanners detected CVE-2015-3630
Top open port discovered on systems with this issue
2376
IPs affected by CVE-2015-3630 2
Find out if you* are
affected by CVE-2015-3630!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2015-3630
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2015-3630
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST |
CWE ids for CVE-2015-3630
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-3630
-
http://seclists.org/fulldisclosure/2015/May/28
Full Disclosure: Docker 1.6.1 - Security Advisory [150507]
-
http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html
Docker Privilege Escalation / Information Disclosure ≈ Packet Storm
-
http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html
openSUSE-SU-2015:0905-1: moderate: Security update for docker
-
http://www.securityfocus.com/bid/74566
Docker CVE-2015-3630 Multiple Security Bypass Vulnerabilities
-
https://groups.google.com/forum/#!searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ
Docker-user - Google Groepen
Products affected by CVE-2015-3630
- cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:*