Docker Race Condition in docker cp Allows Bind Mount Redirection (CVE-2020-42306)

Vulnerability Overview Vulnerability Name: Race condition in docker cp allows bind mount redirection to host path Vulnerability ID: GHSA-r92x-37c3-w2h Severity: High (7.2 / 10) CVSS v3 base metrics: - Attack vector: Local - Attack complexity: High - Privileges required: Low - User interaction: Required - Scope: Changed - Confidentiality: None - Integrity: High - Availability: High CVE ID: CVE-2020-42306 Credits: vvoland (Remediation developer) Description When copying files into a container, the daemon sets up a temporary filesystem view by binding mount volumes into a private namespace. During this setup, mount points are created within the container root directory, and then bind mounts are attached using the container-relative path resolved to an absolute host path. Between the creation of the mount point and the mounting itself, a process running inside the container can replace the target (or parent path components) with a symbolic link pointing to an arbitrary location on the host. The system call follows symbolic links, resulting in the volume being bind-mounted to an arbitrary host path instead of the intended container path. Impact A malicious container can redirect bind mounts of volumes to arbitrary host paths. The impact depends on the volume content and mount options: If the volume is writable, arbitrary host files at the redirected path may be overwritten with the volume's content. If the volume is read-only, the host path is masked during the operation, leading to a denial of service. In all cases, the mount is temporary (removed after completes), but any writes performed remain persistent. Prerequisites for Exploitation The container must have at least one volume mount. Processes within the container must be able to quickly create and swap symbolic links to the volume mount target path. An operator must initiate a to the container, or call the or API endpoints. Not Affected Containers without volume mounts are not affected, as the vulnerability occurs during the volume bind mount setup process. Remediation Run containers only from trusted images. Avoid using with untrusted containers. Use authorization plugins to restrict access to archive API endpoints ( , ). Affected Versions Docker Engine: < 29.5.1 github.com/docker/docker/daemon (Go): <= v28.5.2 github.com/moby/moby/v2/daemon (Go): < v2.0.0-beta.14 Fixed Versions Docker Engine: 29.5.1 github.com/docker/docker/daemon (Go): None github.com/moby/moby/v2/daemon (Go): v2.0.0-beta.14

Goal Reached Thanks to every supporter — we hit 100%!

Docker Race Condition in docker cp Allows Bind Mount Redirection (CVE-2020-42306)

More from this source