CVE-2021-37841
📋 TL;DR
CVE-2021-37841 is an access control vulnerability in Docker Desktop for Windows that allows low-privileged users to compromise containers. Attackers can read, write, and potentially execute code within containers regardless of isolation mode. This affects Windows systems running vulnerable Docker Desktop versions.
💻 Affected Systems
- Docker Desktop for Windows
📦 What is this software?
Desktop by Docker
⚠️ Risk & Real-World Impact
Worst Case
Full container compromise leading to lateral movement, data exfiltration, and potential host system compromise through container escape techniques.
Likely Case
Unauthorized access to container filesystems, sensitive data exposure, and potential privilege escalation within container environments.
If Mitigated
Limited impact with proper network segmentation, container isolation, and strict access controls preventing low-privileged users from accessing Docker infrastructure.
🎯 Exploit Status
Exploitation requires local access to the Windows host with low privileges. No authentication bypass needed beyond initial low-privileged access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Docker Desktop 3.6.0 and later
Vendor Advisory: https://docs.docker.com/docker-for-windows/release-notes/
Restart Required: Yes
Instructions:
1. Download Docker Desktop 3.6.0 or later from docker.com. 2. Run the installer. 3. Restart Docker Desktop. 4. Verify version with 'docker version' command.
🔧 Temporary Workarounds
Restrict Docker Desktop Access
windowsLimit user access to systems running Docker Desktop to only authorized administrators
Use Linux Containers
windowsSwitch to Linux containers instead of Windows containers if possible
docker context use default
docker run --rm -it alpine sh
🧯 If You Can't Patch
- Implement strict access controls to prevent low-privileged users from accessing Docker Desktop hosts
- Monitor for suspicious container activity and implement network segmentation for container environments
🔍 How to Verify
Check if Vulnerable:
Check Docker Desktop version in Settings > About Docker Desktop or run 'docker version' and look for version numberCheck Version:
docker version --format '{{.Client.Version}}'Verify Fix Applied:
Confirm Docker Desktop version is 3.6.0 or higher using 'docker version' command📡 Detection & Monitoring
Log Indicators:
- Unusual container creation by low-privileged users
- Suspicious file access patterns within containers
- Unexpected process execution in containers
Network Indicators:
- Unusual outbound connections from containers
- Data exfiltration patterns from container environments
SIEM Query:
source="docker" AND (event="container_create" OR event="container_start") AND user!="admin" AND user!="root"