CVE-2018-10892

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-10892
The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html Mailing List Third Party Advisory
https://access.redhat.com/errata/RHBA-2018:2796 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2482 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2729 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10892 Issue Tracking Third Party Advisory
https://github.com/moby/moby/pull/37404 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:docker:docker:*:*:*:*:community_edition:*:*:*
cpe:2.3:a:docker:docker:*:*:*:*:enterprise_edition:*:*:*
cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
History

12 Feb 2023, 23:31

Type Values Removed Values Added
CWE NVD-CWE-Other CWE-250
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2018-10892', 'name': 'https://access.redhat.com/security/cve/CVE-2018-10892', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1598581', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1598581', 'tags': [], 'refsource': 'MISC'}
Summary The default OCI Linux spec in oci/defaults{_linux}.go in Docker/Moby, from 1.11 to current, does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling Bluetooth or turning up/down keyboard brightness. The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.

02 Feb 2023, 16:18

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2018-10892 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1598581 -
Summary The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness. The default OCI Linux spec in oci/defaults{_linux}.go in Docker/Moby, from 1.11 to current, does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling Bluetooth or turning up/down keyboard brightness.
Information

Published : 2018-07-06 16:29

Updated : 2023-12-10 12:30

NVD link : CVE-2018-10892

Mitre link : CVE-2018-10892

CVE.ORG link : CVE-2018-10892

JSON object : View

Products Affected

opensuse

  • leap

docker

  • docker

mobyproject

  • moby

redhat

  • openstack
  • enterprise_linux_server
  • enterprise_linux
CWE
CWE-250

Execution with Unnecessary Privileges

NVD-CWE-Other