CVE-2024-8695
📋 TL;DR
A remote code execution vulnerability in Docker Desktop allows malicious extensions to execute arbitrary code by crafting malicious extension descriptions or changelogs. This affects all Docker Desktop users running versions before 4.34.2, potentially allowing attackers to compromise the host system.
💻 Affected Systems
- Docker Desktop
📦 What is this software?
Desktop by Docker
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the host system with root/administrator privileges, enabling data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malicious extension authors could execute arbitrary code on users' systems, potentially stealing credentials, cryptocurrency wallets, or sensitive development data.
If Mitigated
With proper extension vetting and limited extension installation, impact is reduced to only trusted extension sources, though still significant if a trusted extension is compromised.
🎯 Exploit Status
Exploitation requires user to install a malicious extension, but the technical complexity of crafting the exploit is low once the vulnerability is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.34.2
Vendor Advisory: https://docs.docker.com/desktop/release-notes/#4342
Restart Required: Yes
Instructions:
1. Open Docker Desktop. 2. Navigate to Settings > Software Updates. 3. Click 'Check for Updates'. 4. Install version 4.34.2 or later. 5. Restart Docker Desktop.
🔧 Temporary Workarounds
Disable Extension Installation
allPrevent installation of new extensions to block potential malicious extensions.
Remove All Extensions
allUninstall all existing extensions to eliminate potential attack vectors.
docker extension rm [extension-name] for each installed extension
🧯 If You Can't Patch
- Disable Docker Desktop extensions completely
- Use Docker Engine directly without Docker Desktop
🔍 How to Verify
Check if Vulnerable:
Check Docker Desktop version in Settings > Software Updates. If version is below 4.34.2, system is vulnerable.Check Version:
docker version --format '{{.Client.Version}}' (for Docker CLI) or check Docker Desktop GUIVerify Fix Applied:
Confirm Docker Desktop version is 4.34.2 or higher in Settings > Software Updates.📡 Detection & Monitoring
Log Indicators:
- Unusual extension installation activity
- Suspicious process execution from Docker Desktop context
- Unexpected network connections from Docker Desktop processes
Network Indicators:
- Outbound connections from Docker Desktop to unexpected destinations
- DNS queries for suspicious domains from Docker processes
SIEM Query:
process_name:"Docker Desktop" AND (process_cmdline:"extension" OR event_type:"process_execution")