Continuing on what has been a busy year in vulnerability discoveries, a new bug has been found in all versions of the Docker container platform that could allow someone so inclined to cause all sorts of havoc.

The latest vulnerability, conveniently named CVE-2018-15664 for easy reference, allows a witty attacker to target API endpoints behind the docker cp command that would allow them to read and write data on a host machine. The docker cp command copies code between a container’s local file system and the local machine.

The flaw was discovered last week by SUSE Senior Software Engineer Aleksa Sarai. “As far as I'm aware there are no meaningful protections against this kind of attack (other than not allowing ‘docker cp’ on running containers),” he wrote. Sarai did note that he has submitted a patch upstream that is undergoing code review.

The Docker flaw comes on the heels of a “high severity” bug found in the open source Singularity container platform. That flaw allowed an attacker with local or network access to a host machine to gain root access to the container platform.

The Singularity flaw was notable because the container platform has been touted as being more secure than traditional container platforms like Docker. It was initially designed and targeted for use in high-performance computing (HPC) and scientific use cases.

Sylabs, which offers an enterprise-focused version of the Singularity platform, released a fix for the bug.

The latest vulnerabilities follow one discovered in February that impacted the runC container runtime that underpins Docker, cri-o, containerd, and Kubernetes. The bug, dubbed CVE-2019-5736, allowed an infected container to overwrite the host runC binary and gain root-level code access on the host. This would basically allow the infected container to gain control of the overarching host container and allow an attacker to execute any command.

“It is quite likely that most container runtimes are vulnerable to this flaw, unless they took very strange mitigations beforehand,” Sarai explained at the time. He added that the flaw is blocked by the proper implementation of user namespaces “where the host root is not mapped into the container’s user namespace.”

Those flaws also followed the discovery of the first major bug in the Kubernetes container orchestration platform late last year. That “critical” bug impacted all Kubernetes-based products and services, and it gives hackers full administrative privileges on any compute node being run in a Kubernetes cluster.

There have also been a rash of recent security flaws found outside of the container ecosystem. Just this month alone has seen bugs found in Intel processors; an emoji-based attacks on Cisco switches, routers, and firewalls; and a ransomware attack on Git repositories.