2 ms·
No, the vulnerability is within the API for `docker cp`, specifically.
by cpuguy83 7y ago
No, the vulnerability is within the API for `docker cp`, specifically.
- cyphar 7y agoThe only currently known and exploitable API is with `docker cp`, but FollowSymlinkInScope is used all over the place. Unfortunately, fixing FollowSymlinkInScope requires redesigning the API and then redesigning all the callers so they stop passing around path strings blindly and instead pass around handles (which are O_PATH fds). But, as I mentioned in TFA, the plan is to rework https://github.com/cyphar/filepath-securejoin https://github.com/cyphar/filepath-securejoin to have a sane API that detects attacks on older kernels while using the new kernel bits (once merged).