CVE-2021-1645: 
vulnerability analysis and mitigation

CVE-2021-1645 is a Windows Docker Information Disclosure Vulnerability that affects Windows containers. The vulnerability was discovered by Marc Nimmerrichter of Certitude Lab and disclosed in January 2021. The issue affects multiple versions of Windows 10 and Windows Server, including Windows 10 versions 1607 through 20H2 and Windows Server 2016 and 2019 (Rapid7).

The vulnerability stems from a design issue in the Windows Data Protection API (DP API) implementation within containers. The DP API, which allows applications to encrypt arbitrary data, was using the same cryptographic key across all containers. Moreover, these keys were publicly available in base-image layers published by Microsoft. This meant that the encryption operations performed within containers were ineffective since the encryption keys were public (Certitude Advisory). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) (NVD).

The vulnerability compromises the confidentiality of data encrypted using DP API within Windows containers. Any organization that relied on DP API in Windows Docker containers to store encrypted data in potentially insecure locations should consider that data as compromised. The impact is particularly significant as the encryption keys were publicly accessible through Microsoft's base images (Certitude Advisory).

The vulnerability can be exploited by accessing data encrypted with DP API in Windows containers, as the encryption keys were publicly available in the base images. An attacker could decrypt any data that was encrypted using DP API within Windows containers, regardless of which machine or container instance performed the encryption (Certitude Advisory).

Microsoft addressed this vulnerability by releasing patches (KB4598229, KB4598230, KB4598242, KB4598243) for affected Windows Server and Windows 10 operating systems. Organizations should apply both OS updates and base-image updates to address this issue. However, the fix introduces a design change where containers now generate unique DP API keys at first start, which may impact certain use-cases as there is no supported way to share keys between containers (Certitude Advisory).