CVE-2018-20699

MEDIUM

Docker Engine < 18.09 - Denial of Service via Large Integer in CPUSet Parameters

Title source: llm

Description

Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.

References (3)

Core 3

Core References

Patch, Third Party Advisory x_refsource_misc

https://github.com/docker/engine/pull/70

Patch, Third Party Advisory x_refsource_misc

https://github.com/moby/moby/pull/37967

Third Party Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2019:0487

Scores

CVSS v3 4.9

EPSS 0.0009

EPSS Percentile 25.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-400

Status published

Products (2)

docker/engine < 18.09

redhat/enterprise_linux_server 7.0

Published Jan 12, 2019

Tracked Since Feb 18, 2026