-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/moby/moby | go | < 19.3.15 | 19.3.15 |
| github.com/moby/moby | go | >= 20.10.0-beta1, < 20.10.3 | 20.10.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from directory creation functions using remapped namespace credentials (daemon.idMapping.RootPair()) instead of host root credentials. The patched commit 64bd448 shows systematic replacement of these calls with idtools.CurrentIdentity() to enforce host-level permissions. Key functions like MkdirAllAndChown and setupDaemonRoot were creating directories writable by the remapped user, allowing path traversal attacks on Docker's state directories. The graph driver implementations (aufs, overlay, etc.) showed similar vulnerable patterns that were patched by switching to host identity checks.