CVE-2018-10892

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-250

Affected software

No affected versions have been published.

Timeline

Published
Jul 6, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-108938.8Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server CVE-2018-108945.4It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use thiCVE-2018-108958.8qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. A maliciCVE-2018-108967.1The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh hoCVE-2018-108978.1A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configurCVE-2018-108988.8A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuratCVE-2018-108998.8A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for pCVE-2018-10907.5In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with reaCVE-2018-109007.8Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line characCVE-2018-109017.8A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, butCVE-2018-109027.8It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in sndCVE-2018-109037.5A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. I