DEBIAN-CVE-2017-16539

DEBIAN-CVE-2017-16539 PUBLISHED CVSS 5.900000095367432 MEDIUM

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.

Risk Scores

CVSS v3.0

5.900000095367432

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
Debian:12	docker.io	0, 0, 0
Debian:11	docker.io	0, 0, 0
Debian:13	docker.io	0, 0, 0
Debian:14	docker.io	0, 0, 0

Timeline

Nov 4, 2017 CVE Published
Apr 28, 2026 CVE Updated

References

https://security-tracker.debian.org/tracker/CVE-2017-16539 advisory

Open in Interactive Console →