# CVE-2018-15664: Docker Elevation of Privilege Vulnerability

CVE-2018-15664 is fixed in 5 products on 1 platform, first by docker.io 18.09.7-0ubuntu1~18.04.3, released May 22, 2019. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2018-15664
- Priority: High
- CVSS: n/a (Important)
- EPSS: 0.0343
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: yes
- Vendor exploitability assessment: Exploitation Less Likely
- Published: May 22, 2019
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-15664

## Description

<p><strong>Summary</strong></p> <p>CVE-2018-15664 describes a vulnerability in the Docker runtime (and the underlying community project, Moby) wherein a malicious/compromised container can acquire full read/write access to the host operating system where that container is running. The vulnerability depends on the way that the Docker runtime handles symbolic links and is most directly exploitable through the Docker copy API (‘docker cp’ in the Docker CLI).</p> <p><strong>What is the risk for Azure Kubernetes Service (AKS) and Azure IoT Edge customers?</strong></p> <p>The risk for AKS and Azure IoT Edge customers is minimal as the following need to be true:</p> <ul> <li>A container on the host must be compromised.</li> <li>The attacker must have access to the host machine, as the docker API is not exposed by default from outside of the host.</li> </ul>

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | docker-stable opensuse-leap 15.6 | 24.0.9_ce-150000.1.25.1 | [SUSE-SU-2025:03545-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03545-1.md) | Oct 11, 2025 |
| Linux | docker-stable sles 15.6 | 24.0.9_ce-150000.1.25.1 | [SUSE-SU-2025:03545-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03545-1.md) | Oct 11, 2025 |
| Linux | docker-stable sles 15.7 | 24.0.9_ce-150000.1.25.1 | [SUSE-SU-2025:03545-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03545-1.md) | Oct 11, 2025 |
| Linux | docker.io Ubuntu 18.04.6 LTS (bionic) | 18.09.7-0ubuntu1~18.04.3 | [docker.io 18.09.7-0ubuntu1~18.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-docker.io-18.09.7-0ubuntu1-18.04.3.md) | May 22, 2019 |
| Linux | golang-docker-dev Ubuntu 18.04.6 LTS (bionic) | 18.09.7-0ubuntu1~18.04.3 | [golang-docker-dev 18.09.7-0ubuntu1~18.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-golang-docker-dev-18.09.7-0ubuntu1-18.04.3.md) | May 22, 2019 |
| Linux | golang-github-docker-docker-dev Ubuntu 18.04.6 LTS (bionic) | 18.09.7-0ubuntu1~18.04.3 | [golang-github-docker-docker-dev 18.09.7-0ubuntu1~18.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-golang-github-docker-docker-dev-18.09.7-0ubuntu1-18.04.3.md) | May 22, 2019 |
| Linux | vim-syntax-docker Ubuntu 18.04.6 LTS (bionic) | 18.09.7-0ubuntu1~18.04.3 | [vim-syntax-docker 18.09.7-0ubuntu1~18.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-vim-syntax-docker-18.09.7-0ubuntu1-18.04.3.md) | May 22, 2019 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo