Sandbox Bypass Affecting github.com/hashicorp/nomad/drivers/docker package, versions >=0.9.0 <0.10.8 >=0.11.0-beta1 <0.11.7 >=0.12.0-beta1 <0.12.8


0.0
medium
  • Attack Complexity

    Low

  • Scope

    Changed

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-GOLANG-GITHUBCOMHASHICORPNOMADDRIVERSDOCKER-1039759

  • published

    12 Nov 2020

  • disclosed

    12 Nov 2020

  • credit

    Tim Gross

How to fix?

Upgrade github.com/hashicorp/nomad/drivers/docker to version 0.10.8, 0.11.7, 0.12.8 or higher.

Overview

Affected versions of this package are vulnerable to Sandbox Bypass. A vulnerability was discovered in Nomad and Nomad Enterprise (“Nomad”) such that an operator with job submission capabilities can mount the host file system of a client agent and subvert the default Docker file sandbox feature when not explicitly disabled, or when using a volume mount type.

Nomad disables host filesystem access by default in 0.12.0 and above to prevent job operators from accessing the client filesystem used to persistently store any required data on disk. The Docker task driver provides a volume mount type which can be used to access the client host filesystem from within a container, but clients must be configured to enable mounting directories outside an allocation’s path to prevent abuse from unprivileged operators.