Sandbox Bypass Affecting github.com/hashicorp/nomad/drivers/docker package, versions >=0.9.0 <0.10.8 >=0.11.0-beta1 <0.11.7 >=0.12.0-beta1 <0.12.8
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
12 Nov 2020
12 Nov 2020
How to fix?
github.com/hashicorp/nomad/drivers/docker to version 0.10.8, 0.11.7, 0.12.8 or higher.
Affected versions of this package are vulnerable to Sandbox Bypass. A vulnerability was discovered in Nomad and Nomad Enterprise (“Nomad”) such that an operator with job submission capabilities can mount the host file system of a client agent and subvert the default Docker file sandbox feature when not explicitly disabled, or when using a volume mount type.
Nomad disables host filesystem access by default in 0.12.0 and above to prevent job operators from accessing the client filesystem used to persistently store any required data on disk. The Docker task driver provides a volume mount type which can be used to access the client host filesystem from within a container, but clients must be configured to enable mounting directories outside an allocation’s path to prevent abuse from unprivileged operators.