Docker Sandboxes (version 0.14.0) implement an ICMP egress block via an authorizer applied at network creation time. However, when the Docker daemon restarts, networks rebuilt from disk do not have this authorizer reapplied. As a result, a sandbox that survives a restart can forward ICMP packets to arbitrary hosts, circumventing the intended ICMP egress restrictions. This flaw allows an untrusted workload inside the sandbox to bypass the documented ICMP block, enabling network reconnaissance and data exfiltration over ICMP covert channels regardless of the configured allowlist. The vulnerability is tracked as CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints) and CWE-665 (Improper Initialization).

An attacker controlling a workload inside a Docker sandbox can bypass ICMP egress restrictions after a Docker daemon restart, enabling network reconnaissance and covert data exfiltration via ICMP packets. This undermines network segmentation and data confidentiality controls that rely on ICMP blocking. The vulnerability has a CVSS 4.0 score of 5.7 (medium severity), indicating a moderate impact with low attack complexity and partial privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a fix is available, users should be aware that ICMP egress blocking may not persist across Docker daemon restarts in version 0.14.0 and consider additional network-level controls or sandbox isolation measures to mitigate risk.