Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes. This affects Docker Desktop Enterprise before 2.1.0.9, Docker Desktop for Windows Stable before 2.2.0.4, and Docker Desktop for Windows Edge before 2.2.2.0.
References
| Link | Resource |
|---|---|
| https://docs.docker.com/release-notes/ | Release Notes Vendor Advisory |
| https://github.com/active-labs/Advisories/blob/master/2020/ACTIVE-2020-002.md | Third Party Advisory |
| https://github.com/spaceraccoon/CVE-2020-10665 | Exploit Third Party Advisory |
| https://docs.docker.com/release-notes/ | Release Notes Vendor Advisory |
| https://github.com/active-labs/Advisories/blob/master/2020/ACTIVE-2020-002.md | Third Party Advisory |
| https://github.com/spaceraccoon/CVE-2020-10665 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 04:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://docs.docker.com/release-notes/ - Release Notes, Vendor Advisory | |
| References | () https://github.com/active-labs/Advisories/blob/master/2020/ACTIVE-2020-002.md - Third Party Advisory | |
| References | () https://github.com/spaceraccoon/CVE-2020-10665 - Exploit, Third Party Advisory |
Information
Published : 2020-03-18 19:15
Updated : 2024-11-21 04:55
NVD link : CVE-2020-10665
Mitre link : CVE-2020-10665
CVE.ORG link : CVE-2020-10665
JSON object : View
Products Affected
docker
- desktop
CWE
CWE-59
Improper Link Resolution Before File Access ('Link Following')