CVE-2024-6222
📋 TL;DR
This vulnerability allows an attacker who has already broken out of a Docker container into the Docker Desktop VM to further escape to the host operating system by sending malicious IPC messages related to extensions and dashboard. It affects Docker Desktop users on macOS, Linux, and Windows with Hyper-V backend before version 4.29.0. The risk is higher when the 'Allow only extensions distributed through the Docker Marketplace' setting is disabled.
💻 Affected Systems
- Docker Desktop
📦 What is this software?
Desktop by Docker
⚠️ Risk & Real-World Impact
Worst Case
Full host compromise allowing attacker to execute arbitrary code, access sensitive data, and pivot to other systems on the network.
Likely Case
Limited host access for attackers who have already achieved container breakout, potentially leading to data theft or lateral movement.
If Mitigated
No impact if proper version and configuration controls are in place, as the vulnerability requires both vulnerable software and specific configuration.
🎯 Exploit Status
Exploitation requires: 1) Container breakout to Docker Desktop VM, 2) Disabled extension restriction setting, 3) Crafting malicious IPC messages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.29.0 (fixes vulnerability), 4.31.0 (changes default configuration)
Vendor Advisory: https://docs.docker.com/desktop/release-notes/#4290
Restart Required: Yes
Instructions:
1. Update Docker Desktop to version 4.29.0 or later. 2. Ensure 'Allow only extensions distributed through the Docker Marketplace' is enabled. 3. Restart Docker Desktop.
🔧 Temporary Workarounds
Enable Extension Restriction
allEnable the setting to only allow extensions from Docker Marketplace
Open Docker Desktop Settings -> Extensions -> Check 'Allow only extensions distributed through the Docker Marketplace'
🧯 If You Can't Patch
- Enable 'Allow only extensions distributed through the Docker Marketplace' setting in Docker Desktop
- Implement strict container security policies to prevent initial container breakouts
🔍 How to Verify
Check if Vulnerable:
Check Docker Desktop version (must be <4.29.0) AND verify 'Allow only extensions distributed through the Docker Marketplace' setting is disabled.Check Version:
docker version --format '{{.Client.Version}}' (for Docker Desktop version)Verify Fix Applied:
Confirm Docker Desktop version is 4.29.0 or higher AND 'Allow only extensions distributed through the Docker Marketplace' setting is enabled.📡 Detection & Monitoring
Log Indicators:
- Unusual IPC message patterns from containers to Docker Desktop VM
- Extension installation attempts from non-Marketplace sources
Network Indicators:
- Unexpected IPC communication between containers and Docker Desktop components
SIEM Query:
Search for Docker Desktop logs containing 'extension', 'dashboard', or 'IPC' with suspicious source containers