Docker Sandboxes (version 0.14.0) implement ICMP egress blocking through an authorizer applied only during network creation. However, this authorizer is not re-applied when networks are reconstructed from disk after a Docker daemon restart. As a result, sandboxes that survive restarts can forward ICMP packets to arbitrary external hosts, defeating the intended ICMP egress block. This allows untrusted workloads within the sandbox to conduct network reconnaissance and exfiltrate data over ICMP covert channels despite configured allowlists. The vulnerability is identified as CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints) and CWE-665 (Improper Initialization). The CVSS 4.0 base score is 5.1 (medium severity), with local attack vector, low complexity, partial privileges required, and high impact on confidentiality via a covert channel.

An attacker controlling a workload inside a Docker Sandbox can bypass the ICMP egress restrictions intended to block ICMP traffic. This enables the attacker to perform network reconnaissance and exfiltrate data using ICMP covert channels. The impact affects confidentiality but does not affect integrity or availability. The vulnerability requires local access with low privileges and partial user interaction is not required.

Patch status is not yet confirmed — no official fix or remediation level has been published by Docker. Users should monitor Docker's official advisories for updates. Until a fix is available, consider avoiding use of Docker Sandboxes version 0.14.0 in threat-sensitive environments or implement additional network-level controls outside of Docker to restrict ICMP traffic after daemon restarts.