CVE-2018-10892 MEDIUM

CVE-2018-10892

Vendor [Unknown]

Product docker

Weakness CWE-250

Published July 6, 2018

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

6.3/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.

Key dates

02Disclosure timeline

July 6, 2018 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-10892 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/250.html

Related vulnerabilities

04Related CVE

CVE-2026-42833 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability CVE-2024-43583 Winlogon Elevation of Privilege Vulnerability CVE-2022-0070 Log4j hot patch package privilege escalation CVE-2024-9473 GlobalProtect App: Local Privilege Escalation (PE) Vulnerability CVE-2025-62503 Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)