CVE-2020-11492: 
Docker Desktop vulnerability analysis and mitigation

A privilege escalation vulnerability was discovered in Docker Desktop through version 2.2.0.5 on Windows. The vulnerability (CVE-2020-11492) allows a local attacker to gain SYSTEM privileges by setting up their own named pipe prior to starting Docker. When Docker Service (which runs as SYSTEM) attempts to connect to the named pipe, the attacker can intercept the connection and impersonate the service's privileges (NVD, Bleeping Computer).

The vulnerability exists in how Docker Desktop Service communicates as a client to child processes using named pipes for inter-process communication (IPC). The service runs with SYSTEM privileges and can be tricked into connecting to a malicious named pipe set up by a lower-privileged process. Due to Windows named pipes' impersonation feature, once the connection is made, the malicious process can impersonate the Docker Desktop Service account and execute arbitrary system commands with SYSTEM privileges. The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Pentest Partners).

If successfully exploited, an attacker could elevate their privileges to SYSTEM level, gaining complete control over the affected Windows system. This would allow them to execute arbitrary commands with the highest level of privileges (ZDNet).

Docker addressed this vulnerability in version 2.3.0.2 released on May 11, 2020. The fix involves modifying how the Docker service process connects to named pipes of spawned child processes, now using the SecurityIdentification impersonation level. This allows the server end of the pipe to get the identity and privileges of the client but prevents impersonation (Pentest Partners).

Initially, Docker denied the vulnerability existed, suggesting it was a Windows feature that should be addressed by Microsoft. However, after receiving proof-of-concept code demonstrating the issue, Docker acknowledged it as a security vulnerability and developed a fix (Pentest Partners).