Privilege Escalation in Docker Desktop Community Edition (CVE‑2019‑15752) Allows Local Users to Gain Elevated Rights
What It Is – Docker Desktop Community Edition contains a local privilege‑escalation flaw (CVE‑2019‑15752). An attacker who can write to %PROGRAMDATA%\DockerDesktop\version‑bin\ can drop a malicious docker-credential‑wincred.exe that runs with elevated privileges.
Exploitability – The vulnerability is exploitable on any Windows host where Docker Desktop is installed and the attacker has write access to the program data folder. No public exploit code is required; the attack vector is purely local.
Affected Products – Docker Desktop Community Edition (all versions prior to the vendor‑issued fix).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous software‑version monitoring and proof of timely patching as evidence of due‑diligence.
- Highlights gaps in privileged‑account controls; a malicious binary can bypass normal user‑level restrictions.
- Provides auditors with a concrete example of why defensible audit trails of binary integrity and change‑management are essential for enterprise‑level trust.
Recommended Actions
- Deploy the Docker‑provided patch or upgrade to the latest Docker Desktop release.
- Enforce least‑privilege policies on local accounts and restrict write access to
%PROGRAMDATA%\DockerDesktop\. - Implement integrity‑monitoring (e.g., file‑hash baselines) for Docker binaries and integrate findings into your continuous control‑evidence platform.
- Document the remediation steps in your change‑management system to retain audit‑ready evidence.
Source: CISA KEV – CVE‑2019‑15752