CVE-2020-11492

https://notcve.org/view.php?id=CVE-2020-11492

An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up their own named pipe prior to starting Docker with the same name, this attacker can intercept a connection attempt from Docker Service (which runs as SYSTEM), and then impersonate their privileges. Se detectó un problema en Docker Desktop versiones hasta 2.2.0.5 en Windows. Si un atacante local configura su propia tubería nombrada antes de iniciar Docker con el mismo nombre, este atacante puede interceptar un intento de conexión desde Docker Service (que se ejecuta como SYSTEM) y luego suplantar sus privilegios • https://github.com/CrackerCat/CVE-2020-11492 https://docs.docker.com/docker-for-windows/release-notes https://www.pentestpartners.com/security-blog/docker-desktop-for-windows-privesc-cve-2020-11492 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •