Windows Host Compute Service Shim (hcsshim) is an opened upwards source library that helps "Docker for Windows" execute Windows Server containers using a low-level container administration API inwards Hyper-V.
Discovered past times Swiss developer together with safety researcher Michael Hanselmann, the critical vulnerability (tracked every bit CVE-2018-8115) is the lawsuit of the failure of the hcsshim library to properly validate input when importing a Docker container image.
This, inwards turn, allows an aggressor to remotely execute arbitrary code on the Windows host operating system, eventually letting the aggressor create, remove, together with supersede files on the target host.
As Hanselmann explained in his personal blog, "Importing a Docker container ikon or pulling 1 from a remote registry isn't ordinarily expected to brand modifications to the host file arrangement exterior of the Docker-internal information structures."
Hanselmann reported the number to Microsoft inwards Feb this year, together with the tech giant fixed the vulnerability a few days earlier this month’s spell Tuesday past times releasing an updated version of hcsshim.
Although the vulnerability has been assigned a critical severity rating, Microsoft says exploitation of this number is unlikely.
"To exploit the vulnerability, an aggressor would house malicious code inwards a peculiarly crafted container ikon which, if an authenticated administrator imported (pulled), could displace a container administration service utilizing the Host Compute Service Shim library to execute malicious code on the Windows host," Microsoft says inwards its advisory.
The spell for this vulnerability addresses the agency hcsshim validates input from Docker container images, hence blocking the loading of malicious code inwards peculiarly crafted files.
An updated version 0.6.10 of the Windows Host Compute Service Shim (hcsshim) file is available correct similar a shot for download from GitHub.
Full details of the vulnerability accept non been released yet, but Hanselmann promises to divulge in-depth technical details together with a proof-of-concept exploit for the flaw on May 9, next an understanding amongst Microsoft safety reply center.
Microsoft's May 2018 Patch Tuesday has been scheduled for liberate on May 8.
