CVE-2020-27534: Docker Engine Path Traversal Vulnerability

CVE-2020-27534 Overview

A path traversal vulnerability exists in Docker Engine before version 19.03.9 due to insecure temporary file handling in the Builder component. The vulnerability is located in util/binfmt_misc/check.go, where the os.OpenFile function is called with a potentially unsafe qemu-check temporary pathname. This insecure behavior stems from an ioutil.TempDir call that uses an empty first argument, which can lead to predictable temporary file locations.

Critical Impact

Attackers may exploit this vulnerability to access sensitive information through path traversal techniques, potentially compromising container build processes and exposing data on the host system.

Affected Products

• Docker Engine versions prior to 19.03.9
• Moby BuildKit (affected component)
• Docker Desktop installations using vulnerable Docker Engine versions

Discovery Timeline

• 2020-12-30 - CVE-2020-27534 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-27534

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), enabling potential unauthorized access to files outside the intended directory structure. The flaw exists in the Docker Builder's QEMU binary format checking mechanism, which creates temporary files in an insecure manner.

When the ioutil.TempDir function is called with an empty string as its first argument, Go's standard library defaults to using the system's default temporary directory (typically /tmp on Unix-like systems). This behavior, combined with predictable naming patterns, creates a window for potential exploitation where an attacker could manipulate the temporary file path or pre-create files at expected locations.

Root Cause

The root cause lies in the improper use of Go's ioutil.TempDir function within util/binfmt_misc/check.go. When the first argument (the directory parameter) is passed as an empty string, the function uses os.TempDir() to determine the temporary directory location. This approach can be problematic in multi-tenant or shared environments where the temporary directory may be accessible to other processes or users, potentially allowing symlink attacks or file interception.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity and requires no privileges or user interaction. An attacker could potentially:

1. Predict or influence the temporary file path used during container builds
2. Create malicious symlinks at the expected temporary file location before the Docker Builder creates its files
3. Intercept or redirect file operations to access sensitive information or manipulate build processes

The vulnerability primarily impacts confidentiality, allowing potential information disclosure through path traversal techniques during Docker image builds that involve QEMU binary format checks.

Detection Methods for CVE-2020-27534

Indicators of Compromise

• Unusual file access patterns in the system's temporary directory during Docker builds
• Unexpected symlinks appearing in /tmp directory pointing to sensitive file paths
• Docker build processes accessing files outside their expected working directories
• Anomalous QEMU-related file operations during multi-architecture builds

Detection Strategies

• Monitor Docker Engine logs for unusual file access errors during build operations
• Implement file integrity monitoring on temporary directories used by Docker
• Use audit logging to track open() and openat() system calls from Docker Builder processes
• Deploy SentinelOne's container security monitoring to detect anomalous file system operations within build contexts

Monitoring Recommendations

• Enable verbose logging for Docker Builder operations to capture temporary file handling events
• Implement real-time monitoring of the /tmp directory for suspicious symlink creation
• Configure alerts for Docker Engine processes accessing paths outside expected build contexts
• Review Docker build logs periodically for path traversal indicators or unexpected file references

How to Mitigate CVE-2020-27534

Immediate Actions Required

• Upgrade Docker Engine to version 19.03.9 or later immediately
• Audit all Docker hosts to identify vulnerable versions using docker version command
• Restrict access to temporary directories on Docker build hosts
• Implement container isolation to limit the impact of potential exploitation

Patch Information

Docker has addressed this vulnerability in Docker Engine version 19.03.9. The fix modifies the temporary file handling in util/binfmt_misc/check.go to use secure temporary directory practices. The patches are tracked in the GitHub Moby Pull Request and GitHub BuildKit Pull Request. For detailed information about the release, refer to the Docker Release Notes.

Workarounds

• If immediate patching is not possible, implement strict file system permissions on temporary directories
• Use dedicated temporary directories with restricted access for Docker builds by configuring the TMPDIR environment variable
• Deploy mandatory access control (SELinux/AppArmor) policies to restrict Docker Builder's file system access
• Consider running Docker builds in isolated environments with limited host file system access

# Configuration example
# Set a secure dedicated temporary directory for Docker operations
export TMPDIR=/var/lib/docker/tmp
mkdir -p $TMPDIR
chmod 700 $TMPDIR
chown root:root $TMPDIR

# Verify Docker Engine version to ensure patched version is installed
docker version --format '{{.Server.Version}}'