[Nix-dev] NixOS Security Advisory: Docker Local Privilege Escalation

Tue Apr 4 02:19:50 CEST 2017

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Date:    2017-04-03
CVE-ID:  CVE-2017-7412
Service: docker
Type:    local privilege escalation

Summary
=======

NixOS 17.03 before 17.03.887 has a world-writable Docker socket, which
allows local users to gain privileges by executing docker commands.

NixOS 16.09 is not vulnerable.

Resolution
==========

# nix-channel --update

and ensure your NixOS channel is advanced to 17.03.887 or greater.

Workaround
==========

Manually apply socket permission restrictions to the Docker socket. In
your configuration.nix:

  systemd.sockets.docker = {
    socketConfig.SocketMode = "0660";
    socketConfig.SocketUser = "root";
    socketConfig.SocketGroup = "docker";
  };

Thank You
=========
Thank you Alexey Shmalko (rasendubi on GitHub) for promptly reporting
the vulnerablity and submitting a patch.

References
==========

Fix applied to 17.03:
https://github.com/NixOS/nixpkgs/commit/6c59d851e2967410cc8fb6ba3f374b1d3efa988e

Fix applied to unstable:
https://github.com/NixOS/nixpkgs/commit/fa4fe7110566d8370983fa81f2b04a833339236d

16.09 and older are not affected.