CVE-2020-27534: Path Traversal in Moby builder
5.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.72539%
CWE
Published
1/31/2024
Updated
4/22/2024
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/moby/moby | go | < 19.03.9 | 19.03.9 |
| github.com/docker/docker | go | < 19.03.9 | 19.03.9 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from insecure temporary file handling in Docker's binfmt_misc check implementation. The key vulnerable function is identified as checkBinfmtMisc in util/binfmt_misc/check.go, where:
- ioutil.TempDir was called with an empty directory prefix argument, creating temporary files in the system's default temp location
- The generated path was passed to os.OpenFile without proper validation
- This pattern matches the CVE description of 'potentially unsafe qemu-check temporary pathname'
- The patch (moby/moby#40877) would have modified this TempDir call to use a secure directory prefix
- This function would appear in runtime profiles during binfmt_misc checks when processing container architectures