High severity · published Sep 25, 2023
CVE-2023-5165
Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shell
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges.
This issue has been fixed in Docker Desktop 4.23.0.
Affected Docker Desktop versions: from 4.13.0 before 4.23.0.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DD
Docker Desktop · Docker Inc.
4.13.0 before 4.23.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5165
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5165
Release Notes
https://docs.docker.com/desktop/release-notes/#4230
More from Docker Desktop
9.8
CVE-2023-0626
Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route
9.8
CVE-2023-0625
Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog
7.8
CVE-2023-0633
In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in LPE
7.8
CVE-2023-0627
Docker Desktop 4.11.x allows --no-windows-containers flag bypass
7.0
CVE-2024-6222
In Docker Desktop before v4.29.0 an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages