## Summary A race condition during `docker cp` mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. ## Details When copying files into a container, the daemon sets up a temporary filesystem view by bind-mounting volumes into a private mount namespace. During this setup, the mount destination is created inside the container root and then a bind mount is attached using the container-relative path resolved to an absolute host path. Between mountpoint creation and the `mount()` syscall, a process running inside the container can replace the destination (or a parent path component) with a symlink pointing to an arbitrary location on the host. The `mount()` syscall follows the symlink, causing the volume to be bind-mounted onto an arbitrary host path instead of the intended container path. ## Impact A malicious container can redirect a volume bind mount to an arbitrary host path. The impact depends on the volume content and mount options: - If the volume is writable, arbitrary host files at the redirected path could be overwritten with the volume's contents. - If the volume is read-only, the host path is masked by the mount for the duration of the operation, causing denial of service. - In all cases the mount is temporary (torn down after the `docker cp` completes), but the effects of any writes persist. ### Conditions for exploitation - A container must have at least one volume mount. - A process inside the container must be able to rapidly create and swap symlinks at the volume mount destination path. - An operator must initiate a `docker cp` into that container, or call the `PUT /containers/{id}/archive` or `HEAD /containers/{id}/archive` API endpoints. ### Not affected - Containers that do not have volume mounts are not affected, as the race occurs during volume bind-mount setup. ## Workarounds - Only run containers from trusted images. - Avoid using `docker cp` with untrusted running containers. - Use authorization plugins to restrict access to the archive API endpoints (`PUT /containers/{id}/archive`, `HEAD /containers/{id}/archive`).
## Summary A race condition during `docker cp` mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. ## Details When copying files into a container, the daemon sets up a temporary filesystem view by bind-mounting volumes into a private mount namespace. During this setup, the mount destination is created inside the container root and then a bind mount is attached using the container-relative path resolved to an absolute host path. Between mountpoint creation and the `mount()` syscall, a process running inside the container can replace the destination (or a parent path component) with a symlink pointing to an arbitrary location on the host. The `mount()` syscall follows the symlink, causing the volume to be bind-mounted onto an arbitrary host path instead of the intended container path. ## Impact A malicious container can redirect a volume bind mount to an arbitrary host path. The impact depends on the volume content and mount options: - If the volume is writable, arbitrary host files at the redirected path could be overwritten with the volume's contents. - If the volume is read-only, the host path is masked by the mount for the duration of the operation, causing denial of service. - In all cases the mount is temporary (torn down after the `docker cp` completes), but the effects of any writes persist. ### Conditions for exploitation - A container must have at least one volume mount. - A process inside the container must be able to rapidly create and swap symlinks at the volume mount destination path. - An operator must initiate a `docker cp` into that container, or call the `PUT /containers/{id}/archive` or `HEAD /containers/{id}/archive` API endpoints. ### Not affected - Containers that do not have volume mounts are not affected, as the race occurs during volume bind-mount setup. ## Workarounds - Only run containers from trusted images. - Avoid using `docker cp` with untrusted running containers. - Use authorization plugins to restrict access to the archive API endpoints (`PUT /containers/{id}/archive`, `HEAD /containers/{id}/archive`).
Update github.com/moby/moby/v2 to 2.0.0-beta.14 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanDocker: Race condition in docker cp allows bind mount redirection to host path affects github.com/docker/docker (go), github.com/moby/moby (go), github.com/moby/moby/v2 (go). Severity is high. ## Summary A race condition during `docker cp` mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. ## Details When copying files into a container, the daemon sets up a temporary filesystem view by bind-mounting volumes into a private mount namespace. During this setup, the mount destination is created inside the container root and then a bind mount is attached using the container-relative path resolved to an absolute host path. Between mountpoint creation and the `mount()` syscall, a process running inside the container can replace the destination (or a parent path component) with a symlink pointing to an arbitrary location on the host. The `mount()` syscall follows the symlink, causing the volume to be bind-mounted onto an arbitrary host path instead of the intended container path. ## Impact A malicious container can redirect a volume bind mount to an arbitrary host path. The impact depends on the volume content and mount options: - If the volume is writable, arbitrary host files at the redirected path could be overwritten with the volume's contents. - If the volume is read-only, the host path is masked by the mount for the duration of the operation, causing denial of service. - In all cases the mount is temporary (torn down after the `docker cp` completes), but the effects of any writes persist. ### Conditions for exploitation - A container must have at least one volume mount. - A process inside the container must be able to rapidly create and swap symlinks at the volume mount destination path. - An operator must initiate a `docker cp` into that container, or call the `PUT /containers/{id}/archive` or `HEAD /containers/{id}/archive` API endpoints. ### Not affected - Containers that do not have volume mounts are not affected, as the race occurs during volume bind-mount setup. ## Workarounds - Only run containers from trusted images. - Avoid using `docker cp` with untrusted running containers. - Use authorization plugins to restrict access to the archive API endpoints (`PUT /containers/{id}/archive`, `HEAD /containers/{id}/archive`).
AI coding agents often install or upgrade packages automatically in go. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/docker/dockergo | <=28.5.2 | Not reported |
| github.com/moby/mobygo | <=28.5.2 | Not reported |
| github.com/moby/moby/v2go | <2.0.0-beta.14 | 2.0.0-beta.14 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate github.com/moby/moby/v2 to 2.0.0-beta.14 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanDocker: Race condition in docker cp allows bind mount redirection to host path affects github.com/docker/docker (go), github.com/moby/moby (go), github.com/moby/moby/v2 (go). Severity is high. ## Summary A race condition during `docker cp` mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. ## Details When copying files into a container, the daemon sets up a temporary filesystem view by bind-mounting volumes into a private mount namespace. During this setup, the mount destination is created inside the container root and then a bind mount is attached using the container-relative path resolved to an absolute host path. Between mountpoint creation and the `mount()` syscall, a process running inside the container can replace the destination (or a parent path component) with a symlink pointing to an arbitrary location on the host. The `mount()` syscall follows the symlink, causing the volume to be bind-mounted onto an arbitrary host path instead of the intended container path. ## Impact A malicious container can redirect a volume bind mount to an arbitrary host path. The impact depends on the volume content and mount options: - If the volume is writable, arbitrary host files at the redirected path could be overwritten with the volume's contents. - If the volume is read-only, the host path is masked by the mount for the duration of the operation, causing denial of service. - In all cases the mount is temporary (torn down after the `docker cp` completes), but the effects of any writes persist. ### Conditions for exploitation - A container must have at least one volume mount. - A process inside the container must be able to rapidly create and swap symlinks at the volume mount destination path. - An operator must initiate a `docker cp` into that container, or call the `PUT /containers/{id}/archive` or `HEAD /containers/{id}/archive` API endpoints. ### Not affected - Containers that do not have volume mounts are not affected, as the race occurs during volume bind-mount setup. ## Workarounds - Only run containers from trusted images. - Avoid using `docker cp` with untrusted running containers. - Use authorization plugins to restrict access to the archive API endpoints (`PUT /containers/{id}/archive`, `HEAD /containers/{id}/archive`).
AI coding agents often install or upgrade packages automatically in go. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/docker/dockergo | <=28.5.2 | Not reported |
| github.com/moby/mobygo | <=28.5.2 | Not reported |
| github.com/moby/moby/v2go | <2.0.0-beta.14 | 2.0.0-beta.14 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard