CyberRota Analysis
AI-GeneratedDocker on macOS is vulnerable due to improper handling of symlinks by the virtio-fs host server, allowing a malicious guest to escape the shared workspace and access arbitrary host files. This critical vulnerability could lead to unauthorized file modification or host code execution, posing significant risks to system integrity. Organizations using Docker on macOS should prioritize patching this vulnerability to safeguard their environments against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user, potentially achieving host code execution.