CyberRota Analysis
AI-GeneratedDocker Sandboxes are vulnerable due to a misconfiguration that allows unprivileged code within the container to write to a host directory that is intended to be read-only. This could lead to unauthorized data modification or leakage, impacting the integrity of the host system. Organizations using Docker should prioritize addressing this vulnerability to prevent potential exploitation by malicious actors.
Original NVD Description
Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged code inside the sandbox can derive that path and write to a host directory the operator attached read-only.