CVE-2020-27534 Overview
CVE-2020-27534 affects the Builder component in Docker Engine versions before 19.03.9. The flaw resides in util/binfmt_misc/check.go, which calls os.OpenFile using a potentially unsafe qemu-check temporary pathname. The unsafe pathname is constructed through an ioutil.TempDir call that passes an empty first argument, causing the temporary directory to fall back to a predictable system location.
The issue is classified as a path traversal weakness [CWE-22] and carries an EPSS probability of 0.77%. Docker addressed the problem in Engine 19.03.9 and in the related Moby and BuildKit projects.
Critical Impact
A local attacker can leverage the predictable temporary pathname to influence files opened by the Docker Builder process, leading to limited information exposure on affected hosts.
Affected Products
- Docker Engine versions prior to 19.03.9
- Moby project (util/binfmt_misc/check.go)
- BuildKit builds that consume the vulnerable Moby code path
Discovery Timeline
- 2020-12-30 - CVE-2020-27534 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2020-27534
Vulnerability Analysis
The Builder component performs a runtime check to determine whether the host supports binfmt_misc execution of foreign architectures through QEMU. To perform this check, the code creates a temporary directory and writes a qemu-check binary into it. The directory is created using ioutil.TempDir with an empty first argument, which directs Go to use the system default temporary directory returned by os.TempDir.
The resulting pathname is therefore predictable to other local users on the same host. An attacker with local access can anticipate the directory pattern and pre-stage files or symbolic links that influence the file the Builder subsequently opens with os.OpenFile. The vulnerability is constrained to confidentiality impact, as reflected by the CVSS metrics.
Root Cause
The root cause is the empty first argument supplied to ioutil.TempDir. Go's standard library documentation specifies that an empty dir parameter defaults to os.TempDir, a shared location such as /tmp. Combined with a fixed prefix and the use of os.OpenFile rather than a safer atomic creation flag set, the design exposes the Builder to local interference.
Attack Vector
Exploitation requires a local attacker with access to the shared temporary directory used by Docker Engine. The attacker monitors for the predictable qemu-check pathname and races the Builder by creating files or links the process then opens. The vulnerability does not enable remote code execution or privilege escalation on its own, but it can disclose limited information about Builder activity. No public proof-of-concept exploit is referenced in the CVE record.
The vulnerability is described in prose only because no verified exploit code is published. Readers can review the upstream fixes in the GitHub Moby Pull Request and the GitHub BuildKit Pull Request for the exact code changes.
Detection Methods for CVE-2020-27534
Indicators of Compromise
- Unexpected files or symbolic links named with the qemu-check prefix inside the system temporary directory on Docker hosts
- Docker Builder log entries referencing failed binfmt_misc probes or unexpected file content during architecture checks
- Local processes other than dockerd or buildkitd creating files in /tmp that match Builder temporary patterns
Detection Strategies
- Inventory installed Docker Engine versions and flag any host running a version earlier than 19.03.9
- Audit file integrity on /tmp during build operations to identify race conditions targeting Builder temporary files
- Correlate local user activity with Docker Builder invocations to surface attempts to interact with predictable temporary paths
Monitoring Recommendations
- Forward Docker daemon logs and host filesystem audit events to a central analytics platform for retrospective analysis
- Monitor for unprivileged user processes opening or creating files in shared temporary directories used by dockerd
- Alert on Docker Engine version drift across the fleet to ensure patched releases remain deployed
How to Mitigate CVE-2020-27534
Immediate Actions Required
- Upgrade Docker Engine to version 19.03.9 or later on all hosts running the Builder component
- Restrict shell access on Docker hosts to trusted administrators to limit the local attack surface
- Validate that BuildKit and Moby-derived builds use a patched util/binfmt_misc/check.go
Patch Information
Docker addressed the issue in Engine 19.03.9. The corresponding source changes were merged through the GitHub Moby Pull Request and the GitHub BuildKit Pull Request. Release context is available in the Docker Release Notes Archive.
Workarounds
- Limit local user access to Docker hosts and prohibit untrusted shell sessions while a patched release is rolled out
- Configure a dedicated, access-restricted temporary directory for the Docker daemon by setting the TMPDIR environment variable for dockerd
- Disable binfmt_misc based multi-architecture builds on hosts that do not require them until patches are applied
# Configuration example: verify Docker version and restrict tmp directory for dockerd
docker version --format '{{.Server.Version}}'
# Override the temporary directory used by the Docker daemon via systemd
sudo mkdir -p /var/lib/docker-tmp
sudo chown root:root /var/lib/docker-tmp
sudo chmod 700 /var/lib/docker-tmp
sudo systemctl edit docker.service
# Add the following lines:
# [Service]
# Environment="TMPDIR=/var/lib/docker-tmp"
sudo systemctl daemon-reload
sudo systemctl restart docker
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
