Summary
generated automatically from NVD dataDocker Engine before 1.6.1 applies weak permissions to several procfs paths inside containers: /proc/asound, /proc/timer_stats, /proc/latency_stats and /proc/fs. A local user could exploit this through a crafted image to modify the host, read sensitive information, or carry out protocol downgrade attacks. The flaw is classified as CWE-264 and carries a CVSS v2.0 score of 7.2 (HIGH).
NVD description
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
EPSS · FIRST.org
0.55%probability of exploitation in the next 30 days
Higher than 45% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-30, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 18 mai 2015
- Updated
- 17 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.
Weaknesses (CWE)
References (10)
Similar CVEs
Other vulnerabilities of type CWE-264
Running Docker? Know which CVEs hit your version.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.