Bugzilla – Bug 1121768
VUL-0: CVE-2018-20699: docker: denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value
Last modified: 2024-05-07 09:26:09 UTC
CVE-2018-20699 Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20699 https://github.com/docker/engine/pull/70 https://github.com/moby/moby/pull/37967
Adding the container core folks to CC.
It should be noted that upstream Docker has asked for the CVE to be disputed -- because ultimately the attack would require root-level access on the host anyway.
This was fixed and backported in 18.09 a long time ago, and 19.03.x definitely has the fix. I will include it in the changelog.
It should also be noted that this "vulnerability" is not really worthy of a CVE -- you need to be able to modify Docker's configuration to exploit it. If you already have the ability to do that, you could get remote root access by exposing the Docker management socket over TCP (and start a privileged container to access the host as root).
Released.
All done, closing.