x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2017-16539

[tatianab]

CVE-2017-16539 references github.com/moby/moby, which may be a Go module.

Description:
The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2017-16539
• web: https://marc.info/?l=linux-scsi&m=150985455801444&w=2
• fix: moby/moby@a21ecdf
• web: https://marc.info/?l=linux-scsi&m=150985062200941&w=2
• fix: Add /proc/scsi to masked paths moby/moby#35399
• web: https://twitter.com/ewindisch/status/926443521820774401
• Imported by: https://pkg.go.dev/github.com/moby/moby?tab=importedby

Cross references:

• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2022-24769 #390 EFFECTIVELY_PRIVATE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-8fvr-5rqf-3wwh #638 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-v4h8-794j-g8mm #708 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-vj3f-3286-r4pf #751 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2022-36109 #985 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-vp35-85q5-9f25 #1107 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2023-28840 #1699 EFFECTIVELY_PRIVATE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2023-28841 #1700 EFFECTIVELY_PRIVATE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2023-28842 #1701 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/moby/moby
      vulnerable_at: 24.0.7+incompatible
      packages:
        - package: n/a
cves:
    - CVE-2017-16539
references:
    - web: https://marc.info/?l=linux-scsi&m=150985455801444&w=2
    - fix: https://github.com/moby/moby/pull/35399/commits/a21ecdf3c8a343a7c94e4c4d01b178c87ca7aaa1
    - web: https://marc.info/?l=linux-scsi&m=150985062200941&w=2
    - fix: https://github.com/moby/moby/pull/35399
    - web: https://twitter.com/ewindisch/status/926443521820774401

[gopherbot]

Change https://go.dev/cl/540721 mentions this issue: data/excluded: batch add 135 excluded reports