CVE-2018-10892 Missing authorization in docker

Medium 6.3 Published 6 Jul 2018 Updated 5 Aug 2024

Attackers can modify host hardware settings like Bluetooth or brightness by accessing unblocked /proc/acpi paths in default Docker configurations.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2018-10892?

CVE-2018-10892 is a medium-severity missing authorization vulnerability in Opensuse Leap, published on 6 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.

Weakness: CWE-250

Which versions are affected by CVE-2018-10892?

It affects 6 products.

Linux distribution packages (11)

`docker` Red Hat:rhel_extras_other:7	All versions	`2:1.13.1-74.git6e3bb8e.el7`
`docker-client` Red Hat:rhel_extras_other:7	All versions	`2:1.13.1-74.git6e3bb8e.el7`
`docker-common` Red Hat:rhel_extras_other:7	All versions	`2:1.13.1-74.git6e3bb8e.el7`
`docker-debuginfo` Red Hat:rhel_extras_other:7	All versions	`2:1.13.1-74.git6e3bb8e.el7`
`docker-logrotate` Red Hat:rhel_extras_other:7	All versions	`2:1.13.1-74.git6e3bb8e.el7`
`docker-lvm-plugin` Red Hat:rhel_extras_other:7	All versions	`2:1.13.1-74.git6e3bb8e.el7`
`docker-novolume-plugin` Red Hat:rhel_extras_other:7	All versions	`2:1.13.1-74.git6e3bb8e.el7`
`docker-rhel-push-plugin` Red Hat:rhel_extras_other:7	All versions	`2:1.13.1-74.git6e3bb8e.el7`
`docker-v1.10-migrator` Red Hat:rhel_extras_other:7	All versions	`2:1.13.1-74.git6e3bb8e.el7`
`podman` Red Hat:rhel_extras_other:7	All versions	`0:0.9.2-5.git37a2afe.el7_5`
`podman-debuginfo` Red Hat:rhel_extras_other:7	All versions	`0:0.9.2-5.git37a2afe.el7_5`

Products include Docker Docker, Mobyproject Moby, Opensuse Leap, Redhat Enterprise Linux, Redhat Enterprise Linux Server, Redhat Openstack.

How do I fix CVE-2018-10892?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-10892 being exploited?

There is no known exploitation of CVE-2018-10892 in the wild and no public exploit code.

All Opensuse Leap vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-10892, GHSA-hg92-xfw5-qgvm, RHBA-2018:2796, RHSA-2018:2482, UBUNTU-CVE-2018-10892.