CVE-2023-0629

CVEs › CVE-2023-0629

Description

Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sock, or npipe:////.pipe/docker_engine_linux on Windows, via the -H (--host) CLI flag or the DOCKER_HOST environment variable and launch containers without the additional hardening features provided by ECI. This would not affect already running containers, nor containers launched through the usual approach (without Docker's raw socket). The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges. This issue has been fixed in Docker Desktop 4.17.0. Affected Docker Desktop versions: from 4.13.0 before 4.17.0.

Overview

State: PUBLISHED
Assigner (CNA): Docker
CVSS severity: HIGH
CVSS score: 7.1 / 10
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Effective score: 7.1 / 10 HIGH source: CNA overview
CWE(s): CWE-424, CWE-501
Reserved: 2023-02-01
Published: 2023-03-13 12:16 UTC
Last updated: 2025-02-27 21:12 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0629.json
Linked Threat: CVE-2023-0629 — Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containers

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2023-12663
Assigner: Docker
Published: Mar 13, 2023, 11:16:41 AM
Updated: Feb 27, 2025, 8:12:56 PM
EUVD base score (CVSS 3.1): 7.1 / 10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EUVD-reported EPSS: 0.0700
Vendors: Docker Inc.
Products: Docker Desktop (4.13.0 <4.17.0)
Aliases: GHSA-623v-x3rr-q8qh

ENISA description: Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sock, or npipe:////.pipe/docker_engine_linux on Windows, via the -H (--host) CLI flag or the DOCKER_HOST environment variable and launch containers without the additional hardening features provided by ECI. This would not affect already running containers, nor containers launched through the usual approach (without Docker's raw socket). The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges. This issue has been fixed in Docker Desktop 4.17.0. Affected Docker Desktop versions: from 4.13.0 before 4.17.0.

EUVD references (1)

https://docs.docker.com/desktop/release-notes/#4170

Affected products (1)

Vendor	Product	Versions	Platforms
Docker Inc.	Docker Desktop	`4.13.0` (affected)	MacOS, Windows (Hyper-V), Linux

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://docs.docker.com/desktop/release-notes/#4170 release-notes

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

http://cwe.mitre.org/data/definitions/424.html rapid7:cwe.mitre.org
http://cwe.mitre.org/data/definitions/501.html rapid7:cwe.mitre.org
https://attackerkb.com/topics/CVE-2023-0629 rapid7:attackerkb.com
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12663 rapid7:euvd.enisa.europa.eu
https://www.cve.org/CVERecord?id=CVE-2023-0629 rapid7:www.cve.org

Indicators (1)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
domain	`docker.raw.sock`	no local data	2026-05-18 21:20 UTC

Remediations (16)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Security Update Guide FAQs - microsoft.com

web:www.microsoft.com

These Knowledge Base articles accompany all security updates and advisories, and include caveats or known issues with security updates. Additionally, support engineers document common concerns from customers in these KB articles. These Knowledge Base articles are published the Security Update Guide with each release on Patch Tuesday.

2026-06-02 03:50 UTC
Guide to Vulnerability Patching: Process & Best Practices

web:superops.com

Master vulnerability patching to secure your systems. Explore the process, key challenges, and best practices to prevent data breaches and attacks.

2026-06-02 03:50 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-06-02 03:50 UTC
Known Exploited Vulnerabilities Catalog - CISA

web:www.cisa.gov

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.

2026-06-02 03:50 UTC
Windows Server vulnerability can grant system privileges with just a ...

web:www.tomshardware.com

Systems administrators might also find specific patch links and remediation scripts handy. If an attacker can finagle this vulnerability to get System-level of access to domain controllers, the ...

2026-06-02 03:50 UTC
NVD - Home

web:nvd.nist.gov

The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

2026-06-02 03:50 UTC
CVE: Common Vulnerabilities and Exposures

web:www.cve.org

At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

2026-05-22 05:35 UTC
Critical Patch Updates, Critical Security Patch Updates ... - Oracle

web:www.oracle.com

Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.

2026-05-22 05:35 UTC
Oracle April 2026 Critical Patch Update 241 CVEs | Tenable®

web:www.tenable.com

Oracle addresses 241 CVEs in its April Critical Patch Update, the second quarterly update of 2026 with 481 patches, including 34 critical updates.

2026-05-22 05:35 UTC
CVEs and Security Vulnerabilities - OpenCVE

web:app.opencve.io

Explore the latest vulnerabilities and security issues in the CVE database

2026-05-22 05:35 UTC
Patch Tuesday May 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-05-22 05:35 UTC
CVE Vault - CVE Database & Security Research Hub

web:cvevault.com

CVE Vault - Search and explore Common Vulnerabilities and Exposures ( CVE ) database. Find security vulnerabilities by CVE ID, vendor, severity, and year. Stay secure with comprehensive CVE information.

2026-05-22 05:35 UTC
Current Common Vulnerabilities and Exposures - Feedly

web:feedly.com

Welcome to Feedly CVEs — Research critical vulnerabilities ( CVEs ) with all the real-time and historical information you need to assess the risk to your organization. This free resource uses Feedly's AI to synthesize and analyze vulnerability information from across the web, including estimating CVSS scores up to 3 days before it's reported to the NVD.

2026-05-22 05:35 UTC
Patch Tuesday, May 2026 Edition - Krebs on Security

web:krebsonsecurity.com

Microsoft expects that exploitation is more likely. May's Patch Tuesday is a welcome respite from April, which saw Microsoft fix a near-record 167 security flaws.

2026-05-22 05:35 UTC
Nvd - Cve-2026-0629

web:nvd.nist.gov

An official website of the United States government Here's how you know

2026-05-22 05:35 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-22 05:35 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2023-0629.json.

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:17:50.272Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "release-notes",
              "x_transferred"
            ],
            "url": "https://docs.docker.com/desktop/release-notes/#4170"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-0629",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T20:07:27.576557Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T20:12:56.479Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Settings Management",
            "Enhanced Container Isolation"
          ],
          "platforms": [
            "MacOS",
            "Windows (Hyper-V)",
            "Linux"
          ],
          "product": "Docker Desktop",
          "vendor": "Docker Inc.",
          "versions": [
            {
              "lessThan": "4.17.0",
              "status": "affected",
              "version": "4.13.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2023-03-13T11:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to <tt>docker.raw.sock</tt>, or <tt>npipe:////.pipe/docker_engine_linux</tt> on Windows, via the <tt>-H</tt> (<tt>--host</tt>) CLI flag or the <tt>DOCKER_HOST</tt> environment variable and launch containers without the additional hardening features provided by ECI. This would not affect already running containers, nor containers launched through the usual approach (without Docker's raw socket).<br><br>The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges.<br><p>This issue has been fixed in Docker Desktop 4.17.0. <br><br>Affected Docker Desktop versions: from 4.13.0 before 4.17.0.</p>"
            }
          ],
          "value": "Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sock, or npipe:////.pipe/docker_engine_linux on Windows, via the -H (--host) CLI flag or the DOCKER_HOST environment variable and launch containers without the additional hardening features provided by ECI. This would not affect already running containers, nor containers launched through the usual approach (without Docker's raw socket).\n\nThe affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges.\nThis issue has been fixed in Docker Desktop 4.17.0. \n\nAffected Docker Desktop versions: from 4.13.0 before 4.17.0.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-554",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-554 Functionality Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-424",
              "description": "CWE-424: Improper Protection of Alternate Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-501",
              "description": "CWE-501: Trust Boundary Violation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-13T11:16:41.171Z",
        "orgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
        "shortName": "Docker"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.docker.com/desktop/release-notes/#4170"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containers",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
    "assignerShortName": "Docker",
    "cveId": "CVE-2023-0629",
    "datePublished": "2023-03-13T11:16:41.171Z",
    "dateReserved": "2023-02-01T22:40:41.487Z",
    "dateUpdated": "2025-02-27T20:12:56.479Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}