CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS4
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
PASSIVE
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H
AI Score
Confidence
Low
EPSS
Percentile
21.5%
In Docker Desktop before v4.29.0, an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages.
Docker Desktop v4.29.0 https://docs.docker.com/desktop/release-notes/#4290 fixes the issue on MacOS, Linux and Windows with Hyper-V backend.
As exploitation requires โAllow only extensions distributed through the Docker Marketplaceโ to be disabled, Docker Desktopย v4.31.0 https://docs.docker.com/desktop/release-notes/#4310 ย additionally changes the default configuration to enable this setting by default.
[
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"MacOS",
"Linux"
],
"product": "Docker Desktop",
"vendor": "Docker Inc.",
"versions": [
{
"lessThan": "v4.29.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
]
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS4
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
PASSIVE
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H
AI Score
Confidence
Low
EPSS
Percentile
21.5%