CVSS4
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
PASSIVE
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H
AI Score
Confidence
Low
EPSS
Percentile
21.5%
SSVC
Exploitation
none
Automatable
no
Technical Impact
total
In Docker Desktop before v4.29.0, an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages.
Docker Desktop v4.29.0 https://docs.docker.com/desktop/release-notes/#4290 fixes the issue on MacOS, Linux and Windows with Hyper-V backend.
As exploitation requires โAllow only extensions distributed through the Docker Marketplaceโ to be disabled, Docker Desktopย v4.31.0 https://docs.docker.com/desktop/release-notes/#4310 ย additionally changes the default configuration to enable this setting by default.
[
{
"cpes": [
"cpe:2.3:a:docker:desktop:*:*:*:*:*:*:*:*"
],
"vendor": "docker",
"product": "desktop",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "4.29.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]
CVSS4
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
PASSIVE
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H
AI Score
Confidence
Low
EPSS
Percentile
21.5%
SSVC
Exploitation
none
Automatable
no
Technical Impact
total