Docker Sandboxes (sbx) version 0.14.0 implements an ICMP egress block using an authorizer applied only at network creation time. However, when the Docker daemon restarts and networks are rebuilt from disk, this authorizer is not re-applied, resulting in a restart-surviving sandbox that forwards ICMP traffic to arbitrary hosts. This flaw allows an untrusted workload inside the sandbox to circumvent the intended ICMP egress restrictions, enabling network reconnaissance and covert data exfiltration over ICMP regardless of the configured allowlist. The vulnerability is tracked as CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints) and CWE-665 (Improper Initialization).

An attacker controlling a workload inside a Docker sandbox can bypass the ICMP egress block after a Docker daemon restart, allowing ICMP traffic to arbitrary external hosts. This can facilitate network reconnaissance and covert data exfiltration over ICMP channels, potentially exposing sensitive information despite configured network allowlists. The vulnerability does not allow privilege escalation or direct code execution but compromises network isolation controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be aware that Docker daemon restarts may temporarily disable ICMP egress restrictions in Docker Sandboxes. Consider avoiding reliance solely on ICMP egress blocking for sensitive workloads or implement additional network monitoring and controls to detect anomalous ICMP traffic.