CVE-2014-9356
Description
It was found that a malicious container image could overwrite arbitrary portions of the host file system by including absolute symlinks, potentially leading to privilege escalation.
Statement
This issue affects the versions of Docker as shipped with Red Hat Enterprise Linux 7. However, this flaw is not known to be exploitable under any supported scenario. A future update may address this issue.
Red Hat does not support or recommend running untrusted images.
In Red Hat OpenStack Platform, because the flaw's impact is low and docker is not directly used by the director-operator, no update will be provided at this time for the operator containers.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v2 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.4 | 8.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Access Complexity | High | Low | N/A |
| Authentication | None | None | N/A |
| Confidentiality Impact | None | None | N/A |
| Integrity Impact | Complete | Complete | N/A |
| Availability Impact | None | Partial | N/A |
Vector
Red Hat: AV:N/AC:H/Au:N/C:N/I:C/A:N
NVD: AV:N/AC:L/Au:N/C:N/I:C/A:P
Acknowledgements
Red Hat would like to thank Docker Inc. for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
