CVE-2023-0629

Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sock, or npipe:////.pipe/docker_engine_linux on Windows, via the -H (--host) CLI flag or the DOCKER_HOST environment variable and launch containers without the additional hardening features provided by ECI. This would not affect already running containers, nor containers launched through the usual approach (without Docker&amp;#39;s raw socket).<br /> <br /> The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges.<br /> This issue has been fixed in Docker Desktop 4.17.0. <br /> <br /> Affected Docker Desktop versions: from 4.13.0 before 4.17.0.<br /> <br />