The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- CVSS 3.0 Base Score: 6.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-dockeramazon-linux-ami-2-upgrade-docker-debuginfo | Jul 4, 2022 | Jul 6, 2018 | |
| Amazon_linux | — | amazon-linux-upgrade-docker | Sep 7, 2018 | Jul 6, 2018 |
| Centos_linux | — | centos-upgrade-dockercentos-upgrade-docker-clientcentos-upgrade-docker-commoncentos-upgrade-docker-debuginfocentos-upgrade-docker-logrotatecentos-upgrade-docker-lvm-plugincentos-upgrade-docker-novolume-plugincentos-upgrade-docker-rhel-push-plugincentos-upgrade-docker-v1-10-migrator | Aug 28, 2019 | Jul 6, 2018 |
| Debian | debian-upgrade-docker-io | Jul 30, 2024 | Jul 6, 2018 | |
| Docker_ce | docker-ce-upgrade-18_06_0 | Nov 25, 2019 | Jul 6, 2018 | |
| Docker_ee | docker-ee-upgrade-latest | Nov 25, 2019 | Jul 6, 2018 | |
| Redhat_linux | — | redhat-upgrade-dockerredhat-upgrade-docker-clientredhat-upgrade-docker-commonredhat-upgrade-docker-debuginforedhat-upgrade-docker-logrotateredhat-upgrade-docker-lvm-pluginredhat-upgrade-docker-novolume-pluginredhat-upgrade-docker-rhel-push-pluginredhat-upgrade-docker-v1-10-migrator | Aug 17, 2018 | Jul 6, 2018 |
| Suse | — | suse-upgrade-containerdsuse-upgrade-containerd-ctrsuse-upgrade-dockersuse-upgrade-docker-bash-completionsuse-upgrade-docker-fish-completionsuse-upgrade-docker-libnetworksuse-upgrade-docker-runcsuse-upgrade-docker-testsuse-upgrade-docker-zsh-completionsuse-upgrade-golang-github-docker-libnetwork | Aug 30, 2019 | Jul 6, 2018 |
| Ubuntu | ubuntu-upgrade-docker-io | Nov 19, 2024 | Jul 6, 2018 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jul 6, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub