Permissions, Privileges, and Access Controls in Docker - CVE-2016-8867
Published: October 28, 2016 / Updated: August 9, 2020
Vulnerability identifier: #VU40066
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-8867
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
Affected software
Docker
Fedora
docker
Fedora
docker
How to mitigate CVE-2016-8867
Install update from vendor's website.
docker - addressed in versions 1.12.3-2.git91ae1d1.fc25, 1.12.3-3.git91ae1d1.fc25, 1.12.3-6.git9a594b9.fc25