Permissions, Privileges, and Access Controls in Docker Desktop - CVE-2020-10665
Published: May 27, 2020 / Updated: July 15, 2020
Vulnerability identifier: #VU28297
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-10665
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application mishandles the collection of diagnostics with Administrator privileges,
leading to arbitrary DACL permissions overwrites and arbitrary file
writes.A local user can execute arbitrary code with NT AUTHORITY\SYSTEM privileges.
Affected software
Docker Desktop
How to mitigate CVE-2020-10665
Install updates from vendor's website.
Docker Desktop - update to 2.2.0.4