GHSA-vfjc-2qcw-j95jMediumCVSS 5.9

Docker Moby /proc/scsi Path Exposure Allows Host Data Loss (SCSI MICDROP)

Published
May 17, 2022
Last Modified
January 29, 2026

🔗 CVE IDs covered (1)

CVE-2017-16539 →

📋 Description

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.

🎯 Affected products1

  • go/github.com/moby/moby:< 17.12.0-ce

🔗 References (7)