I ended up having a discussion about Docker and system security today and we came to the point where we asked ourselves of the latest CVE-2016-0728 exploit (privilege escalation) would affect Docker containers as well.

Docker utilizes the system kernel (which may be vulnerable) but isolates the the user (root within it's own little space). My questions are the following:

  • Does CVE-2016-0728 affect Docker instances?
  • Will users within a container be able to use CVE-2016-0728 to break out of the container?
  • 1
    I think this is really a question for Docker. The obvious answer would be to download their PoC and run it in a Docker container to see what happens. You would also have to be running Linux Kernel v3.18+
    – RoraΖ
    Jan 20, 2016 at 16:57

3 Answers 3


This is not a privilege escalation where code gets "only" executed as a higher privileged user. This issue is about execution of code inside the Linux kernel, i.e. the kernel which gets shared between all docker instances and the OS containing the docker instances. This is the highest privilege one could get and at this level one can bypass any kind of restrictions. This means that an unprivileged user which is able to execute this attack can break out of the container.

  • FWIW I think that Docker 1.10 with seccomp filters may not fall to this as it restricts access to the syscalls used by the exploit. Feb 12, 2016 at 18:16

First of all, yes; if your kernel supports keyrings, then docker doesn't prevent their use, which means they also don't prevent exploitation.

But it's worth noting that docker containers are not security containers. While they can and usually do offer some level of security, that isn't their purpose, and design decisions were made that are not compatible with virtualizing hostile code. Isolation has to happen at a layer above that.


As of Docker 1.10 the answer is that this wouldn't work with the default installation, as the keyctl system call is blocked by the default seccomp filter.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .