CVE-2018-10892
First published: Thu Jul 05 2018(Updated: )
The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Docker Docker | >=1.11<=18.03.1 | |
| Docker Docker | >=1.11<=18.03.1 | |
| Mobyproject Moby | >=1.11<=17.03.2 | |
| Redhat Openstack | =12 | |
| Redhat Enterprise Linux | =7.0 | |
| Redhat Enterprise Linux Server | =7.0 | |
| openSUSE Leap | =15.0 | |
| openSUSE Leap | =15.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html
- https://access.redhat.com/errata/RHBA-2018:2796
- https://access.redhat.com/errata/RHSA-2018:2482
- https://access.redhat.com/errata/RHSA-2018:2729
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10892
- https://github.com/moby/moby/pull/37404
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1598585
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1598583
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1598582
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1599131
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1599130
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1599135
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1599134
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1598581#c17
- https://bugzilla.redhat.com/show_bug.cgi?id=1598581
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-10892.
What is the severity of CVE-2018-10892?
The severity of CVE-2018-10892 is medium with a CVSS score of 5.3.
Which software versions are affected by CVE-2018-10892?
Docker/Moby versions 1.11 to current (up to 18.03.1) and Red Hat Enterprise Linux versions 7.0 and OpenSUSE Leap versions 15.0 and 15.1 are affected by CVE-2018-10892.
How can the attacker exploit CVE-2018-10892?
An attacker can exploit CVE-2018-10892 by modifying the host's hardware, such as enabling/disabling bluetooth or adjusting keyboard brightness.
Are there any references for CVE-2018-10892?
Yes, you can find more information on CVE-2018-10892 at the following references: 1. http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html 2. https://access.redhat.com/errata/RHBA-2018:2796 3. https://access.redhat.com/errata/RHSA-2018:2482
- collector/nvd-index
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-10892
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/docker
- canonical/docker docker
- version/docker docker/1.11
- version/docker docker/18.03.1
- vendor/mobyproject
- canonical/mobyproject moby
- version/mobyproject moby/1.11
- version/mobyproject moby/17.03.2
- vendor/redhat
- canonical/redhat openstack
- version/redhat openstack/12
- canonical/redhat enterprise linux
- version/redhat enterprise linux/7.0
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/7.0
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/15.0
- version/opensuse leap/15.1