The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify hosts hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Docker | Docker | 1.11 (including) | 18.03.1 (including) |
| Moby | Mobyproject | 1.11 (including) | 17.03.2 (including) |
| Red Hat Enterprise Linux 7 Extras | RedHat | podman-0:0.9.2-5.git37a2afe.el7_5 | * |
| Red Hat Enterprise Linux 7 Extras | RedHat | docker-2:1.13.1-74.git6e3bb8e.el7 | * |
| Docker.io | Ubuntu | artful | * |
| Docker.io | Ubuntu | bionic | * |
| Docker.io | Ubuntu | cosmic | * |
| Docker.io | Ubuntu | devel | * |
| Docker.io | Ubuntu | esm-apps/bionic | * |
| Docker.io | Ubuntu | esm-infra/xenial | * |
| Docker.io | Ubuntu | xenial | * |