Vulnerability identifier: #VU36754

Vulnerability risk: High

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-15514

CWE-ID: CWE-502

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Docker
Server applications / Virtualization software

Vendor: Docker Inc.

Description

The vulnerability allows a remote authenticated user to execute arbitrary code.

HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over the \.pipedockerBackend named pipe without verifying the validity of the deserialized .NET objects. This would allow a malicious user in the "docker-users" group (who may not otherwise have administrator access) to escalate to administrator privileges.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Docker: 1.10.0.0-0 - 18.05.0

---

External links
http://www.securityfocus.com/bid/105202
http://docs.docker.com/docker-for-windows/edge-release-notes/
http://docs.docker.com/docker-for-windows/release-notes/
http://srcincite.io/blog/2018/08/31/you-cant-contain-me-analyzing-and-exploiting-an-elevation-of-privilege-in-docker-for-windows.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.