Lucene search

DockerCVELIST:CVE-2023-5165

HistorySep 25, 2023 - 3:29 p.m.

CVE-2023-5165 Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shell

2023-09-2515:29:12

CWE-862

CWE-424

Docker

www.cve.org

docker

desktop

eci

bypass

fix

vulnerability

patch

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

8.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges.

This issue has been fixed in Docker Desktop 4.23.0.

Affected Docker Desktop versions: from 4.13.0 before 4.23.0.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "MacOS",
      "Linux",
      "x86",
      "ARM"
    ],
    "product": "Docker Desktop",
    "vendor": "Docker Inc.",
    "versions": [
      {
        "lessThan": "4.23.0",
        "status": "affected",
        "version": "4.13.0",
        "versionType": "semver"
      }
    ]
  }
]

References

docs.docker.com/desktop/release-notes/#4230

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

8.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Related for CVELIST:CVE-2023-5165