Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shell
CVE-2023-5165

7.1HIGH

Key Information:

Vendor

Docker Inc.

Status
Docker Desktop
Vendor
CVE Published:
25 September 2023

What is CVE-2023-5165?

Docker Desktop prior to version 4.23.0 contains a vulnerability that allows unprivileged users to bypass Enhanced Container Isolation (ECI) restrictions through the debug shell. This debug shell remains accessible for a limited time after the launch of Docker Desktop, posing a risk to environments where users lack local root or Administrator privileges. This issue particularly affects Docker Business customers and has been resolved in Docker Desktop version 4.23.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Docker Desktop Windows 4.13.0 < 4.23.0

References

https://docs.docker.com/desktop/release-notes/#4230
release-notes

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

L. Kofler
JSON
.