TL;DR

Local exploit of a Docker Desktop grpcfuse kernel module flaw can lead to unauthorized info exposure, CVSS rating 6.5.

What happened

['Docker Desktop contains an out-of-bounds read in the grpcfuse kernel module.', 'This vulnerability allows local attackers to disclose sensitive information on affected systems.']

Why it matters for ops

['Local access is required for exploitation but can be used by attackers with low privileges.', "The flaw affects Docker Desktop's security by exposing sensitive data that could aid further attacks."]

Mitigation

  • Update Docker Desktop to the latest version with security patches.
  • Enable and configure SELinux/AppArmor for enhanced file access control.

Action items

  • Verify all systems running Docker Desktop are updated.
  • Monitor systems closely for any unusual activity related to the affected module.

Detection IOCs

  • Unexpected requests to /proc or /sys filesystems
  • Anomalies in system call patterns around the grpc service

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-125/