CVE-2020-11492: docker docker_desktop Race Condition

Vulnerability summary

CVE-2020-11492 is a high (CVSS 7.8) Race Condition vulnerability in docker docker_desktop. EPSS estimates a 1.02% chance of exploitation in the next 30 days, higher than 62.7% of scored vulnerabilities.

Timeline

1. 05-06-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up their own named pipe prior to starting Docker with the same name, this attacker can intercept a connection attempt from Docker Service (which runs as SYSTEM), and then impersonate their privileges.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.