CVE-2018-10892

Advisory lineage Upstream: 0 Downstream: 12
Modified
Published: 06 Jul 2018, 16:00
Last modified:05 Aug 2024, 07:54

Vulnerability Summary

Overall Risk (default)
medium
25/100
CVSS Score
6.3 MEDIUM
v3.0 (cve.org)
EPSS Score
0.11% LOW
0% probability -0.07%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

06 Jul 2018, 16:00
Published
Vulnerability first disclosed
05 Aug 2024, 07:54
Last Modified
Vulnerability information updated

Description

The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  • v3.0•MEDIUM•Score: 6.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 0.11%• Percentile: 30%

Techniques & Countermeasures

  • CWE-250•Execution with Unnecessary Privileges

    The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Affected Systems

  • docker•docker

    ≥ 1.11, ≤ 18.03.1

  • mobyproject•moby

    ≥ 1.11, ≤ 17.03.2

  • opensuse•leap

    15.0 | 15.1

  • redhat•enterprise_linux

    7.0

  • redhat•enterprise_linux_server

    7.0

  • redhat•openstack

    12

  • [unknown]•docker

    n/a

References (6)