Docker Desktop up to 4.16.x ECI Restriction improper protection of alternate path

Summaryinfo

A vulnerability was found in Docker Desktop up to 4.16.x. It has been rated as critical. Impacted is an unknown function of the component ECI Restriction Handler. The manipulation leads to improper protection of alternate path. This vulnerability is uniquely identified as CVE-2023-0629. Local access is required to approach this attack. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Docker Desktop up to 4.16.x (Virtualization Software). This issue affects an unknown function of the component ECI Restriction Handler. The manipulation with an unknown input leads to a improper protection of alternate path vulnerability. Using CWE to declare the problem leads to CWE-424. The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sock, or npipe:////.pipe/docker_engine_linux on Windows, via the -H (--host) CLI flag or the DOCKER_HOST environment variable and launch containers without the additional hardening features provided by ECI. This would not affect already running containers, nor containers launched through the usual approach (without Docker's raw socket). The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges. This issue has been fixed in Docker Desktop 4.17.0. Affected Docker Desktop versions: from 4.13.0 before 4.17.0.

The weakness was disclosed 03/13/2023. It is possible to read the advisory at docs.docker.com. The identification of this vulnerability is CVE-2023-0629 since 02/01/2023. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 4.17.0 eliminates this vulnerability. The upgrade is hosted for download at docs.docker.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Virtualization Software

Vendor

• Docker

Name

• Desktop

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14
• 4.15
• 4.16

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion