CVE-2017-16539

Name	CVE-2017-16539
Description	The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	900140

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
docker.io (PTS)	bullseye	20.10.5+dfsg1-1+deb11u2	fixed
	bullseye (security)	20.10.5+dfsg1-1+deb11u3	fixed
	bookworm	20.10.24+dfsg1-1+deb12u1	fixed
	sid, trixie	26.1.5+dfsg1-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
docker.io	source	(unstable)	1.13.1~ds3-1			900140

https://github.com/moby/moby/pull/35399
https://github.com/moby/moby/pull/35399/commits/a21ecdf3c8a343a7c94e4c4d01b178c87ca7aaa1