Permissions, Privileges, and Access Controls in Docker Desktop - CVE-2020-10665
Published: May 27, 2020 / Updated: July 15, 2020
Vulnerability identifier: #VU28297
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2020-10665
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vendor: Docker Inc.
Affected software:
Docker Desktop
Docker Desktop
Detailed vulnerability description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application mishandles the collection of diagnostics with Administrator privileges,
leading to arbitrary DACL permissions overwrites and arbitrary file
writes.A local user can execute arbitrary code with NT AUTHORITY\SYSTEM privileges.
How to mitigate CVE-2020-10665
Install updates from vendor's website.