High severity7.0NVD Advisory· Published Jul 9, 2024· Updated Jun 17, 2026
CVE-2024-6222
CVE-2024-6222
Description
In Docker Desktop before v4.29.0, an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages.
Docker Desktop v4.29.0 https://docs.docker.com/desktop/release-notes/#4290 fixes the issue on MacOS, Linux and Windows with Hyper-V backend.
As exploitation requires "Allow only extensions distributed through the Docker Marketplace" to be disabled, Docker Desktop v4.31.0 https://docs.docker.com/desktop/release-notes/#4310 additionally changes the default configuration to enable this setting by default.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: <4.29.0
Patches
Vulnerability mechanics
References
1- docs.docker.com/desktop/release-notes/nvdRelease Notes
News mentions
0No linked articles in our index yet.