Docker Desktop Privilege Escalation Vulnerability Bypassing Enhanced Container Isolation

A vulnerability in Docker Desktop allows local attackers to escalate privileges by bypassing Enhanced Container Isolation (ECI) restrictions. When ECI is enabled, Docker socket mounts from containers are generally denied unless explicitly allowed. However, the Docker CLI --use-api-socket flag can be used to add socket mounts in a way that ECI does not properly enforce, granting containers full access to the Docker Engine socket. This access could be exploited to retrieve authentication credentials for container registries, potentially leading to further privilege escalation.

Impact

Exploitation of this vulnerability allows for unauthorized access to the Docker Engine, bypassing ECI restrictions, and could lead to privilege escalation on the host system.

Remediation

This vulnerability has been fixed in Docker Desktop version 4.59.0.