CVE-2021-3162
📋 TL;DR
CVE-2021-3162 is a local privilege escalation vulnerability in Docker Desktop for macOS where improper certificate checking allows attackers to gain elevated privileges. This affects macOS users running Docker Desktop Community versions before 2.5.0.0. An attacker with local access could exploit this to execute code with higher privileges than intended.
💻 Affected Systems
- Docker Desktop Community
📦 What is this software?
Docker by Docker
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains root privileges on the macOS host system, enabling complete system compromise, data theft, and persistence.
Likely Case
Local user or malware escalates privileges to install additional malicious software, access sensitive data, or modify system configurations.
If Mitigated
With proper access controls and monitoring, impact is limited to isolated Docker environments without affecting critical host systems.
🎯 Exploit Status
Exploitation requires local access to the macOS system. Public proof-of-concept code exists and demonstrates the certificate validation bypass.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.0.0 and later
Vendor Advisory: https://docs.docker.com/docker-for-mac/release-notes/#docker-desktop-community-2500
Restart Required: Yes
Instructions:
1. Open Docker Desktop on macOS. 2. Click the Docker menu icon. 3. Select 'Check for Updates'. 4. Install version 2.5.0.0 or later. 5. Restart Docker Desktop after installation.
🔧 Temporary Workarounds
Disable Docker Desktop
allTemporarily disable Docker Desktop to prevent exploitation while planning upgrade.
docker --context desktop-linux stop
docker --context desktop-linux rm -f $(docker --context desktop-linux ps -aq)
🧯 If You Can't Patch
- Restrict local access to macOS systems running vulnerable Docker Desktop versions
- Implement strict privilege separation and monitor for unusual privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Docker Desktop version in About Docker Desktop menu or run: docker version --format '{{.Client.Version}}'Check Version:
docker version --format '{{.Client.Version}}'Verify Fix Applied:
Verify version is 2.5.0.0 or higher using: docker version --format '{{.Client.Version}}'📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events in macOS system logs
- Docker Desktop certificate validation errors
Network Indicators:
- Local certificate validation bypass attempts
SIEM Query:
source="macos_system_logs" AND (event="privilege_escalation" OR process="docker")