Sandbox Bypass Affecting github.com/hashicorp/nomad/drivers/docker package, versions >=0.9.0 <0.10.8 >=0.11.0-beta1 <0.11.7 >=0.12.0-beta1 <0.12.8
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMHASHICORPNOMADDRIVERSDOCKER-1039759
- published 12 Nov 2020
- disclosed 12 Nov 2020
- credit Tim Gross
Introduced: 12 Nov 2020
CVE-2020-28348 Open this link in a new tabHow to fix?
Upgrade github.com/hashicorp/nomad/drivers/docker to version 0.10.8, 0.11.7, 0.12.8 or higher.
Overview
Affected versions of this package are vulnerable to Sandbox Bypass. A vulnerability was discovered in Nomad and Nomad Enterprise (“Nomad”) such that an operator with job submission capabilities can mount the host file system of a client agent and subvert the default Docker file sandbox feature when not explicitly disabled, or when using a volume mount type.
Nomad disables host filesystem access by default in 0.12.0 and above to prevent job operators from accessing the client filesystem used to persistently store any required data on disk. The Docker task driver provides a volume mount type which can be used to access the client host filesystem from within a container, but clients must be configured to enable mounting directories outside an allocation’s path to prevent abuse from unprivileged operators.