CVE-2024-6222: In Docker Desktop before v4.29.0 an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages
In Docker Desktop before v4.29.0, an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages.
Docker Desktop v4.29.0 https://docs.docker.com/desktop/release-notes/#4290 fixes the issue on MacOS, Linux and Windows with Hyper-V backend.
As exploitation requires "Allow only extensions distributed through the Docker Marketplace" to be disabled, Docker Desktop v4.31.0 https://docs.docker.com/desktop/release-notes/#4310 additionally changes the default configuration to enable this setting by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Docker Desktopto a version that resolves this vulnerability.Fixed in 4.29.0 - Configuration
In Docker Desktop v4.29.0 and later, the default configuration enables “Allow only extensions distributed through the Docker Marketplace” (this should be left enabled).
Docker Desktop Allow only extensions distributed through the Docker Marketplace = enabled - Operational
If any versions prior to 4.29.0 were exposed, validate that the Docker Desktop configuration has “Allow only extensions distributed through the Docker Marketplace” enabled after upgrading.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6222?
CVE-2024-6222 is considered a high-severity vulnerability due to the potential for an attacker to escape from a container to the host system.
How do I fix CVE-2024-6222?
To mitigate CVE-2024-6222, upgrade Docker Desktop to version 4.29.0 or later.
What systems are affected by CVE-2024-6222?
CVE-2024-6222 affects Docker Desktop versions prior to 4.29.0.
Can CVE-2024-6222 be exploited remotely?
No, CVE-2024-6222 requires an attacker to have gained access to the Docker Desktop VM via a container breakout.
What does CVE-2024-6222 allow an attacker to do?
CVE-2024-6222 allows an attacker to escape from the Docker Desktop VM to the host system.