PT-2023-13527 · Docker · Docker Desktop For Windows

Published 2023-04-27 · Updated 2025-01-31 · CVE-2022-37326

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Docker Desktop for Windows versions prior to 4.6.0

Description The issue allows attackers to delete or create any file through the "dockerBackendV2 windowscontainers/start" API endpoint by controlling the pidfile field inside the DaemonJSON field in the WindowsContainerStartRequest class. This can indirectly lead to privilege escalation.

Recommendations For versions prior to 4.6.0, update to version 4.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "dockerBackendV2 windowscontainers/start" API endpoint until a patch is available. Avoid using the pidfile field in the DaemonJSON field of the WindowsContainerStartRequest class in the affected API endpoint until the issue is resolved.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-37326

Affected Products

Docker Desktop For Windows

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-37326 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37326 · Vendor Advisory
• https://t.me/cvenotify/109541 · Telegram Post
• https://cyberark.com/resources/threat-research-blog/breaking-docker-named-pipes-systematically-docker-desktop-privilege-escalation-part-2 · Note
• https://t.me/cibsecurity/63015 · Telegram Post
• https://docs.docker.com/desktop/release-notes/#docker-desktop-460 · Note
• https://t.me/cvenotify/49235 · Telegram Post