PT-2018-13063 · Docker · Docker For Windows+1

Published 2018-09-01 · Updated 2018-11-09 · CVE-2018-15514

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Docker for Windows versions prior to 18.06.0-ce-rc3-win68 (edge) and prior to 18.06.0-ce-win72 (stable)

Description The issue allows a malicious user in the "docker-users" group to escalate to administrator privileges by deserializing requests over the named pipe without verifying the validity of the deserialized .NET objects. This is due to the HandleRequestAsync function not properly validating the deserialized .NET objects.

Recommendations For Docker for Windows versions prior to 18.06.0-ce-rc3-win68 (edge) and prior to 18.06.0-ce-win72 (stable), update to version 18.06.0-ce-rc3-win68 (edge) or 18.06.0-ce-win72 (stable) to resolve the issue. As a temporary workaround, consider restricting access to the "docker-users" group to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2018-15514

Affected Products

Docker

Docker For Windows

References · 6

• 🔥 https://srcincite.io/blog/2018/08/31/you-cant-contain-me-analyzing-and-exploiting-an-elevation-of-privilege-in-docker-for-windows.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-15514 · Vendor Advisory
• https://docs.docker.com/docker-for-windows/release-notes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15514 · Security Note
• https://docs.docker.com/docker-for-windows/edge-release-notes · Vendor Advisory
• http://securityfocus.com/bid/105202 · Note