Docker DesktopのWSL2版で隔離を回避、修正版あり
Summary
Windows版Docker DesktopのWSL2環境で、コンテナからWindows側のファイルに届いてしまう脆弱性が公表されました。Docker Desktop 4.98.0以降とWSL 3.0.3以降の両方へ、開発機を更新してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Windows版Docker DesktopのWSL2環境で、コンテナからWindows側のファイルに届いてしまう脆弱性が公表されました。Docker Desktop 4.98.0以降とWSL 3.0.3以降の両方へ、開発機を更新してください。
Original description The description as published by the source.
In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory nvd.nist.gov
- advisory github.com
- web security@docker.com
- web security@docker.com
- web security@docker.com
- web github.com