CVE-2018-10892

Aliases:DEBIAN-CVE-2018-10892CGA-2f8w-58gf-33w6CGA-4q2g-vpx6-63qqCGA-54hv-5c4c-gh78CGA-7wjg-8vhj-vhcwCGA-cp26-2wmx-94x8CGA-gq3v-5f4x-qc8vCGA-p3c2-9727-9x3gCGA-r6rv-2p5q-3pg9CGA-vc97-9hp6-6ffhCGA-vp2f-9mp4-9672
Advisory lineage Upstream: 0 Downstream: 12
Modified
Published: 06 Jul 2018, 16:00
Last modified:05 Aug 2024, 07:54

Vulnerability Summary

Overall Risk (default)
medium
25/100
CVSS Score
6.3 MEDIUM
v3.0 (cve.org)
EPSS Score
1.13% LOW
1% probability +0.94%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

06 Jul 2018, 16:00
Published
Vulnerability first disclosed
05 Aug 2024, 07:54
Last Modified
Vulnerability information updated

Description

The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  • v3.0•MEDIUM•Score: 6.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 1.13%• Percentile: 65%

Techniques & Countermeasures

  • CWE-250•Execution with Unnecessary Privileges

    The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Affected Systems

  • chainguard•py3-docker

    < 0

  • chainguard•py3.10-docker

    < 0

  • chainguard•py3.11-docker

    < 0

  • chainguard•py3.12-docker

    < 0

  • chainguard•py3.13-docker

    < 0

  • wolfi•py3-docker

    < 0

  • wolfi•py3.10-docker

    < 0

  • wolfi•py3.11-docker

    < 0

  • wolfi•py3.12-docker

    < 0

  • wolfi•py3.13-docker

    < 0

  • debian•docker.io

    < 18.06.1+dfsg1-1 | < 18.06.1+dfsg1-1 | < 18.06.1+dfsg1-1 | < 18.06.1+dfsg1-1

  • docker•docker

    ≥ 1.11, ≤ 18.03.1

  • mobyproject•moby

    ≥ 1.11, ≤ 17.03.2

  • opensuse•leap

    15.0 | 15.1

  • redhat•enterprise_linux

    7.0

  • redhat•enterprise_linux_server

    7.0

  • redhat•openstack

    12

  • [unknown]•docker

    n/a

References (7)