CVE-2023-0629
Docker Desktop 4.13.0 – 4.17.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NSummary
CVE-2023-0629 is a high-severity Improper Protection of Alternate Path (CWE-424) vulnerability in Docker Docker Desktop. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-12663
Vulnerability Data
Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sock, or npipe:////.pipe/docker_engine_linux on Windows, via the -H (--host) CLI flag or the DOCKER_HOST environment variable and launch containers…
more
without the additional hardening features provided by ECI. This would not affect already running containers, nor containers launched through the usual approach (without Docker's raw socket). The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges. This issue has been fixed in Docker Desktop 4.17.0. Affected Docker Desktop versions: from 4.13.0 before 4.17.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 6 hardening rules · 4 OS baselines
—
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Documenting requirements and authorizing remote access ensures proper protection of alternate paths.
Establishes and maintains trust boundaries with external organizations before allowing their systems to interact with organization resources.
Prevents information from crossing trust boundaries without explicit approved authorizations.
Defining interfaces, controls, and trust responsibilities in agreements helps prevent violations of trust boundaries during data exchanges.
Authorizing and reviewing connections helps maintain proper trust boundaries between internal components.
Controlling media movement outside controlled areas maintains separation between internal and external trust boundaries.
Review of inter-system matching programs identifies and corrects trust-boundary violations before data crosses organizational or policy domains.
Defines explicit trust boundaries for PII use via documented purposes and prevents processing outside those boundaries.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing and reviewing authorizations across all access paths directly prevents alternate-path bypasses.
Secure-development practices (coding standards, reviews, validation) directly prevent mixing trusted and untrusted data inside the same structures.
Documented data-flow representations make trust boundaries explicit and help surface mixing of trusted/untrusted data.
Logical segmentation and unauthorized-access protections reduce the attack surface of unprotected alternate paths.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Privileged access rights must be enforced on every possible route to privileged functions.
Secure architecture principles require explicit trust zones and data segregation, mitigating mixing of trusted/untrusted data.
Secure coding standards can enforce input validation and data tagging, but do not guarantee architectural separation.
Security testing can discover unprotected alternate paths before release.
Information access restriction mechanisms must close all alternate paths to restricted data or functions.
Access control policy directly requires protection of all entry points to restricted functionality.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 9 (1 rule)
- V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-424
RHEL 9 (1 rule)
- V-258078 RHEL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-424
Ubuntu 22.04 (1 rule)
- V-260529 Ubuntu 22.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. prevents CWE-424
Ubuntu 24.04 (1 rule)
- V-270708 Ubuntu 24.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. prevents CWE-424