CVE-2020-10665

Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes. This affects Docker Desktop Enterprise before 2.1.0.9, Docker Desktop for Windows Stable before 2.2.0.4, and Docker Desktop for Windows Edge before 2.2.2.0.

CVSS v3.1 NVD

6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

1.44% chance of exploitation in the next 30 days, 73rd percentile

Published

2020-03-18

Updated

2024-08-04

Proof-of-concept exploits (1)

• spaceraccoon/CVE-2020-1066552★ · 2020-06-25

Security advisories

• https://docs.docker.com/release-notes
• active-labs/Advisories/blob/master/2020/ACTIVE-2020-002.md

References

• CVE Record
• NVD entry