CVE-2018-20699

Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-m… (CVE-2018-20699)

Description

Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.

Source: CVELISTV5 NVD

Metrics

Severity

medium

73.48

—

no public PoC known

4.9

Source: nvd-v3

CVSS v3

4.9

CVSS v4

—

EPSS percentile

81.7 %

Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).

EPSS score

2.2 %

Moderate — model estimates 1-10% exploitation likelihood.

Published

2019-01-12 02:00 UTC

CWE

—

Affected operating systems

linux
redhat / enterprise_linux_server7.0

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

docker
engine18.09

References & sources

IDCVE-2018-20699