Resource exhaustion in Docker Engine - CVE-2018-20699

Vulnerability identifier: #VU64818

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-20699

CWE-ID: CWE-400

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker on the local network to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker on the local network can cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.

Docker Engine
IBM Edge Application Manager
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
Fedora
docker-latest
docker
docker (Red Hat package)
IBM Fusion HCI
Storage Ceph

Install updates from vendor's website.

Docker Engine - update to 18.09.0
docker-latest - update to 1.13.1-40.git1185cfd.fc29
docker - addressed in versions 1.13.1-63.git1185cfd.fc28, 1.13.1-63.git1185cfd.fc29
docker (Red Hat package) - update to 1.13.1-94.gitb2f74b2.el7
IBM Fusion HCI - update to 2.8.0
Storage Ceph - update to 7.1

• https://bugzilla.redhat.com/show_bug.cgi?id=1666565
• https://github.com/docker/engine/pull/70
• https://github.com/moby/moby/pull/37967

• Red Hat Enterprise Linux 7 Extras update for docker
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Storage Fusion HCI
• Multiple vulnerabilities in IBM Storage Ceph
• Fedora 29 update for docker
• Fedora 28 update for docker
• Fedora 29 update for docker-latest