CVE-2018-15664: Race Condition

Published May 23, 2019
·
Updated

In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).

Affected Software

65 affected componentsFixes available
Docker Docker=17.06.0-ce
Docker Docker=17.06.0-ce-rc1
Docker Docker=17.06.0-ce-rc2
Docker Docker=17.06.0-ce-rc3
Docker Docker=17.06.0-ce-rc4
Docker Docker=17.06.0-ce-rc5
Docker Docker=17.06.1-ce
Docker Docker=17.06.1-ce-rc1
Docker Docker=17.06.1-ce-rc2
Docker Docker=17.06.1-ce-rc3
Docker Docker=17.06.1-ce-rc4
Docker Docker=17.06.2-ce
Docker Docker=17.06.2-ce-rc1
Docker Docker=17.07.0-ce
Docker Docker=17.07.0-ce-rc1
Docker Docker=17.07.0-ce-rc2
Docker Docker=17.07.0-ce-rc3
Docker Docker=17.07.0-ce-rc4
Docker Docker=17.09.0-ce
Docker Docker=17.09.0-ce-rc1
Docker Docker=17.09.0-ce-rc2
Docker Docker=17.09.0-ce-rc3
Docker Docker=17.09.1-ce
Docker Docker=17.09.1-ce--rc1
Docker Docker=17.10.0-ce
Docker Docker=17.10.0-ce-rc1
Docker Docker=17.10.0-ce-rc2
Docker Docker=17.11.0-ce
Docker Docker=17.11.0-ce-rc1
Docker Docker=17.11.0-ce-rc2
Docker Docker=17.11.0-ce-rc3
Docker Docker=17.11.0-ce-rc4
Docker Docker=17.12.0-ce
Docker Docker=17.12.0-ce-rc1
Docker Docker=17.12.0-ce-rc2
Docker Docker=17.12.0-ce-rc3
Docker Docker=17.12.0-ce-rc4
Docker Docker=17.12.1-ce
Docker Docker=17.12.1-ce-rc1
Docker Docker=17.12.1-ce-rc2
Docker Docker=18.01.0-ce
Docker Docker=18.01.0-ce-rc1
Docker Docker=18.02.0-ce
Docker Docker=18.02.0-ce-rc1
Docker Docker=18.02.0-ce-rc2
Docker Docker=18.03.0-ce
Docker Docker=18.03.0-ce-rc1
Docker Docker=18.03.0-ce-rc2
Docker Docker=18.03.0-ce-rc3
Docker Docker=18.03.0-ce-rc4
Docker Docker=18.03.1-ce
Docker Docker=18.03.1-ce-rc1
Docker Docker=18.03.1-ce-rc2
Docker Docker=18.04.0-ce
Docker Docker=18.04.0-ce-rc1
Docker Docker=18.04.0-ce-rc2
Docker Docker=18.05.0-ce
Docker Docker=18.05.0-ce-rc1
Docker Docker=18.06.0-ce
Docker Docker=18.06.0-ce-rc1
Docker Docker=18.06.0-ce-rc2
Docker Docker=18.06.0-ce-rc3
Docker Docker=18.06.1-ce-rc1
Docker Docker=18.06.1-ce-rc2
debian/docker.io
20.10.5+dfsg1-1+deb11u220.10.5+dfsg1-1+deb11u420.10.24+dfsg1-1+deb12u126.1.5+dfsg1-927.5.1+dfsg4-1

Event History

May 23, 2019
CVE Published
via MITRE·01:58 PM
Data Sourced
via MITRE·01:58 PM
Description
May 28, 2019
Data Sourced
via Red Hat·05:25 PM
DescriptionSeverityAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·10:52 PM
Description
Feb 20, 2026
Data Sourced
via Ubuntu·05:22 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·05:23 PM
DescriptionAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2018-15664?

CVE-2018-15664 is considered critical as it allows arbitrary read-write access to the host filesystem with root privileges.

2

How do I fix CVE-2018-15664?

To fix CVE-2018-15664, update Docker to versions 20.10.5+dfsg1-1+deb11u2 or later, or apply applicable patches.

3

Which Docker versions are affected by CVE-2018-15664?

CVE-2018-15664 affects Docker versions prior to 20.10.5, including various releases from 17.06.0-ce up to 18.06.1-ce.

4

What type of attack does CVE-2018-15664 exploit?

CVE-2018-15664 exploits a symlink-exchange vulnerability along with directory traversal attacks.

5

What are the consequences of exploiting CVE-2018-15664?

Exploitation of CVE-2018-15664 can result in unauthorized access to sensitive files and potential system compromise due to root-level access.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203