CVE-2018-10892: Medium severity Docker Docker vulnerability
The deafult OCI linux spec in oci/defaults{linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.
Other sources
The default OCI linux spec in oci/defaults{linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-10892.
What is the severity of CVE-2018-10892?
The severity of CVE-2018-10892 is medium with a CVSS score of 5.3.
Which software versions are affected by CVE-2018-10892?
Docker/Moby versions 1.11 to current (up to 18.03.1) and Red Hat Enterprise Linux versions 7.0 and OpenSUSE Leap versions 15.0 and 15.1 are affected by CVE-2018-10892.
How can the attacker exploit CVE-2018-10892?
An attacker can exploit CVE-2018-10892 by modifying the host's hardware, such as enabling/disabling bluetooth or adjusting keyboard brightness.
Are there any references for CVE-2018-10892?
Yes, you can find more information on CVE-2018-10892 at the following references: 1. http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html 2. https://access.redhat.com/errata/RHBA-2018:2796 3. https://access.redhat.com/errata/RHSA-2018:2482