CVE-2018-10892 The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disab...
MediumCVSS 5.3
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/docker.io(Debian:12) | < 18.06.1+dfsg1-1 | 18.06.1+dfsg1-1 |
| debian/docker.io(Debian:13) | < 18.06.1+dfsg1-1 | 18.06.1+dfsg1-1 |
| debian/docker.io(Debian:14) | < 18.06.1+dfsg1-1 | 18.06.1+dfsg1-1 |
| docker github.com/docker/docker | >= 1.11, <= 18.03.1 | No fix listed |
| mobyproject moby | >= 1.11, <= 17.03.2 | No fix listed |
| redhat openstack | = 12 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| openSUSE leap | = 15.0 | No fix listed |
| openSUSE leap | = 15.1 | No fix listed |
| [UNKNOWN] docker | All versions | No fix listed |
References
- Debian Security Tracker CVE-2018-10892 vendor-advisory
- openSUSE-SU-2019:2021 mailing-list third-party-advisory vendor-advisory
- RHBA-2018:2796 third-party-advisory vendor-advisory
- RHSA-2018:2482 third-party-advisory vendor-advisory
- RHSA-2018:2729 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com third-party-advisory
- bugs.debian.org issue-tracking