CVE-2018-15514: HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over the \\.\pi...

Description

HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over the \\.\pipe\dockerBackend named pipe without verifying the validity of the deserialized .NET objects. This would allow a malicious user in the "docker-users" group (who may not otherwise have administrator access) to escalate to administrator privileges.

Metrics

EPSS Probability

2.47%

82.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-502

Affected Software

Vendor	Product	Versions	Update
Docker	Docker	1.10.0.0-0	—
Docker	Docker	1.10.1.42-1	—
Docker	Docker	1.10.2.12	—
Docker	Docker	1.10.2.14	—
Docker	Docker	1.10.4.0	—
Docker	Docker	1.10.6	—
Docker	Docker	1.11.0	—
Docker	Docker	1.11.1	Beta11
Docker	Docker	1.11.2	Beta15
Docker	Docker	1.12.0	—
Docker	Docker	1.12.1	—
Docker	Docker	1.12.2	Beta29.2
Docker	Docker	1.12.3	—
Docker	Docker	1.12.5	—
Docker	Docker	1.13.0	—
Docker	Docker	1.13.1	—
Docker	Docker	17.0.4	Win7
Docker	Docker	17.0.5	Win9
Docker	Docker	17.03.0	—
Docker	Docker	17.03.1	Win12
Docker	Docker	17.04.0	Win6
Docker	Docker	17.06.0	Win13
Docker	Docker	17.06.1	Rc1-Win20
Docker	Docker	17.06.2	Win27
Docker	Docker	17.07.0	Rc1-Win21
Docker	Docker	17.09.0	Rc1-Win28
Docker	Docker	17.09.1	Win42
Docker	Docker	17.10.0	Win36
Docker	Docker	17.11.0	Rc2-Win37
Docker	Docker	17.12.0	Rc2-Win41
Docker	Docker	18.01.0	Win48
Docker	Docker	18.02.0	Rc1-Win50
Docker	Docker	18.03.0	Rc3-Win56
Docker	Docker	18.03.1	Win65
Docker	Docker	18.04.0	Rc2-Win61
Docker	Docker	18.05.0	Rc1-Win63

References

http://www.securityfocus.com/bid/105202Third Party Advisory, VDB Entry
https://docs.docker.com/docker-for-windows/edge-release-notes/Vendor Advisory
https://docs.docker.com/docker-for-windows/release-notes/Vendor Advisory
https://srcincite.io/blog/2018/08/31/you-cant-contain-me-analyzing-and-exploiting-an-elevation-of-privilege-in-docker-for-windows.htmlExploit, Third Party Advisory
http://www.securityfocus.com/bid/105202Third Party Advisory, VDB Entry
https://docs.docker.com/docker-for-windows/edge-release-notes/Vendor Advisory
https://docs.docker.com/docker-for-windows/release-notes/Vendor Advisory
https://srcincite.io/blog/2018/08/31/you-cant-contain-me-analyzing-and-exploiting-an-elevation-of-privilege-in-docker-for-windows.htmlExploit, Third Party Advisory

Timeline

Published: Sep 1, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-15514?

HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over the \\.\pipe\dockerBackend named pipe without verifying the validity of the deserialized .NET objects. This would allow a malicious user in the "docker-users" group (who may not otherwise have administrator access) to escalate to administrator privileges.

How severe is CVE-2018-15514?

Severity scoring for CVE-2018-15514 is pending analysis. The EPSS model estimates a 2.47% probability of exploitation in the next 30 days.

How do I fix CVE-2018-15514?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2018

View all 2018CVEs →