Aller au contenu
en Se connecter
7.3 Élevée

CVE-2024-6222 In Docker Desktop before v4.29.0, an attacker who has gained access to the Docker Desktop VM through a container…

Description

In Docker Desktop before v4.29.0, an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages. Docker Desktop v4.29.0 https://docs.docker.com/desktop/release-notes/#4290 fixes the issue on MacOS, Linux and Windows with Hyper-V backend. As exploitation requires "Allow only extensions distributed through the Docker Marketplace" to be disabled, Docker Desktop  v4.31.0 https://docs.docker.com/desktop/release-notes/#4310  additionally changes the default configuration to enable this setting by default.

Produits et versions touchés

Produit Versions touchées Corrigé en
Docker Desktop 4.29 premières → < 4.29.0 4.29.0
desktop 4.29 premières → < 4.29.0 4.29.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Docker Desktop

Les 11 CVE de Docker Desktop →
CVE-2025-14740 Docker Desktop for Windows contains multiple incorrect permission assignment vulnerabilities in the installer's handling… 6.7 Moyenne CVE-2024-5652 In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service… 6.1 Moyenne CVE-2023-0633 In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in local privilege escalation… 7.2 Élevée CVE-2023-0627 Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local… 6.7 Moyenne
Suivre cette CVE