Docker contains an unpatched rare condition vulnerability

A major security vulnerability has been found in Docker containers.

The Docker containers are said to be holding several major security vulnerabilities as a function in it called FollowSymlinkInScope can be exploited by attackers to modify resource paths.

This flaw was found out by a security researcher Aleksa Sarai who witnessed a Time-of-check to time-of-use (TOCTOU) attack because of the said function.

The vulnerability is yet to be patched from Docker's side, and it is to be noted that all the current docker versions contain this flaw.

FollowSymlinkInScope function was found incorrectly resolving resource paths in Docker container.

According to Sarai, an attacker adding a symbolic link after the faulty resolution can read and write access to the resource path, leading to a race condition.

There are two exploits scripts for this vulnerability which allows the modification of resource paths. “Attacked are two reproducers of the issue. They both include a Docker image which contains a simple binary that does a RENAME_EXCHANGE of a symlink to "/" and an empty directory in a loop, hoping to hit the race condition. In both of the scripts, the user is trying to copy a file to or from a path containing the swapped symlink,” Sarai stated.

Docker Inc is expected to release a patch for this flaw anytime soon.