CVE-2021-41091

CVE-2021-41091 该漏洞利用深入分析了 CVE-2021-41091 安全漏洞，并提供了如何利用漏洞利用脚本在主机上实现权限提升的分步指南。 漏洞概述 CVE-2021-41091 是 Moby（Docker 引擎）中的一个缺陷，由于权限限制不当，允许非特权 Linux 用户在数据目录（通常位于 /var/lib/docker）中遍历并执行程序。当容器包含具有扩展权限（例如 setuid）的可执行程序时，就会出现此漏洞。非特权 Linux 用户随后可以发现并执行这些程序，并且如果主机上用户的 UID 与容器内的文件所有者或组匹配，还可以修改文件。 Overlay 文件系统...

Vulnerable-Docker-Engine

CVE-2021-41091 本漏洞利用深入分析了 CVE-2021-41091 安全漏洞，并提供了如何使用该漏洞利用脚本在主机上实现权限提升的分步指南。 漏洞概述 CVE-2021-41091 是 Moby（Docker 引擎）中的一个缺陷，由于权限限制不当，允许非特权 Linux 用户遍历并执行数据目录（通常位于 /var/lib/docker）内的程序。当容器包含具有扩展权限（例如 setuid）的可执行程序时，就会出现此漏洞。非特权 Linux 用户随后可以发现并执行这些程序，如果主机上用户的 UID 与容器内的文件所有者或组匹配，还可以修改文件。 覆盖文件系统...

dd

dd Ejecuta contenedores de Linux en macOS — sin VM. ¿Qué es dd? dd ejecuta contenedores de Linux de forma nativa en macOS con Apple Silicon sin una máquina virtual. No hay núcleo de Linux ni hipervisor subyacente: un JIT traduce el código del contenedor y procesa sus llamadas al sistema de Linux ...

Docker-Container-CVE-2020-13401

CVE-2020-13401 研究 对Docker 19.03.11之前版本中容器的CVE-2020-13401漏洞的研究 使用 Docker Engine 19.03.11 之前版本创建的容器容易接收并应用来自网络中其他容器的伪造 RA（路由器通告）消息。接收 RA 是操作系统的正常行为，但如果 RA 发送方在网络中不可信，受害容器会接收该消息并加入网络，然后将所有网络数据包发送到新的伪造路由器（ 中间人攻击 ）。此问题与 IPv4 无关，基于 IPv6。 原始 CVE 条目来源：CVE-2020-13401 为什么会发生？ 在 Docker Engine 19.03.11...

cve-2025-9074-poc

CVE-2025-9074 教育用 PoC・概念验证代码 本仓库包含一个用于教育目的的 PoC，演示了利用 Docker Engine 的未认证远程 API 创建可读写主机文件系统的特权容器的风险。 执行文件为 poc.go。 重要：本 PoC 仅限用于教育及防御目的。禁止在第三方环境或未经授权的系统上执行。 危险性评估 综合评估：严重 预估 CVSS v3.1 基本分：9.8 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 依据： 未认证即可访问 TCP/2375 → PR:N, UI:N, AV:N 通过特权容器 +...

CVE-2025-9074-PoC

Docker API 未授权 RCE CVE-2025-9074 一个严重的 CVE-2025-9074 漏洞存在于 Docker Desktop 中，使得本地运行的 Linux 容器能够通过默认子网 192.168.65.7:2375 连接到 Docker Engine API。无论是否启用增强容器隔离 ECI 或 TCP 暴露设置，该问题仍然存在。针对 CVE-2025-9074 的概念验证 PoC 利用代码已公开。该漏洞可能导致主机系统上的用户文件被未经授权访问。因此，风险等级被评定为高风险。 一个独立的 Bash 脚本，用于利用未经认证的暴露 Docker API（通常为端口...

PoC-for-CVE-2025-9074

CVE-2025-9074 - PoC de Acceso No Autenticado a la API de Docker 📌 Descripción general Este repositorio proporciona un exploit de Prueba de Concepto PoC para CVE-2025-9074 , que implica la exposición no autenticada de la API de Docker Engine en el puerto TCP 2375. Un atacante que pueda acceder a...

EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2026-3735)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privileg...

CVE-2025-9074-Docker-Desktop-Container-Escape

CVE-2025-9074：Docker Desktop 容器逃逸 PoC CVE-2025-9074 的概念验证利用程序——Docker Desktop 中的一个严重容器逃逸漏洞，允许未授权访问 Docker Engine API。 漏洞概述 属性| 值 ---|--- CVE ID| CVE-2025-9074 CVSS 评分| 9.3（严重） 受影响软件| Docker Desktop 4.44.3 受影响平台| Windows、macOS（Linux 不受影响） 修复版本| Docker Desktop 4.44.3+ 发现者| Felix Boulet、Philippe Dug...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source container framework. In Docker Engine before version 29.5.1, Docker Daemon versions 28.5.2 and earlier, and Moby Daemon before version 2.0.0-beta.14, a race condition during the docker cp mount setup allowed a malicious container to redirect a bind mount target to an...

Astra Linux – Vulnerability in docker.io

Moby is an open-source project created by Docker to enable software containerization. A bug was discovered in Moby Docker Engine where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates the supplementary group permissions, they may be abl...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and earlier, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during the docker cp mount setup allowed a malicious container to create empty files or directories at...

Astra Linux – Vulnerability in docker.io

Moby is an open-source project created by Docker to enable software containerization. A bug was discovered in Moby Docker Engine where attempting to copy files using docker cp into a specially crafted container can result in changes to Unix file permissions for existing files in the host’s...

EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2026-3330)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privileg...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins AuthZ under specific circumstances. The likelihood of this being exploited...

Astra Linux – Vulnerability in docker.io

Moby is an open-source project created by Docker to enable software containerization. A bug was discovered in Moby Docker Engine, where the data directory /var/lib/docker, contained subdirectories with insufficiently restricted permissions. This allowed unprivileged Linux users to access and...

EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2026-2646)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to...

EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2026-2686)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to...

EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2026-2525)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to...

EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2026-2585)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to...