CVE-2024-6222

CVE-2024-6222 is a high-severity vulnerability affecting Docker Desktop on macOS, Linux, and Windows (Hyper-V backend) before version 4.29.0. An attacker who has already achieved a container breakout within the Docker Desktop VM can exploit this flaw to escape to the host system by manipulating inter-process communication (IPC) messages related to extensions and the dashboard. The vulnerability has a CVSS score of 7.0 (HIGH), indicating a local attack vector with high complexity, requiring low privileges, and no user interaction, leading to high impact on confidentiality, integrity, and availability. Exploitation requires the "Allow only extensions distributed through the Docker Marketplace" setting to be disabled, which was the default configuration in earlier versions. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage. Docker Desktop v4.29.0 fixes the issue, and v4.31.0 further mitigates it by enabling the aforementioned security setting by default.