Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containers

CVE-2023-0629

What is CVE-2023-0629?

Docker Desktop versions prior to 4.17.0 are susceptible to a vulnerability that allows unprivileged users to bypass Enhanced Container Isolation (ECI) restrictions by modifying the Docker host configuration. This can be executed through the -H (--host) command-line option or by changing the DOCKER_HOST environment variable, enabling users to launch containers without the enhanced security measures provided by ECI. Note that this issue only affects Docker Business customers and does not impact currently running containers or those started through conventional methods. The vulnerability has been addressed in Docker Desktop 4.17.0.

References