Summary
Cory Snider discovered that Docker incorrectly handled networking packet
encapsulation. An attacker could use this issue to inject internet
packets in established connection, possibly causing a denial of service or
bypassing firewall protections. This issue only affected Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. (CVE-2023-28840, CVE-2023-28841,
CVE-2023-28842)
Rory McNamara discovered that Docker incorrectly handled cache in the
BuildKit toolkit. An attacker could possibly use this issue to expose
sensitive information. (CVE-2024-23651)
It was discovered that Docker incorrectly handled parallel operations in
some circumstances, which could possibly lead to undefined behavior.
(CVE-2024-36621, CVE-2024-36623)
Rory McNamara discovered that Docker incorrectly verified file paths during
a certain command in the BuildKit toolkit. An attacker could possibly use
this issue to delete arbitrary files from the system. (CVE-2024-23652)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | docker.io | 20.10.21-0ubuntu1~18.04.3+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | docker.io | 20.10.21-0ubuntu1~20.04.6+esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | docker.io | 20.10.21-0ubuntu1~22.04.7+esm2 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | docker.io | 20.10.25+dfsg1-2ubuntu1+esm2 |
Vulnerabilities 7
-
Critical 10.0CVE-2024-23652 Public exploit
BuildKit possible host system access from mount stub cleaner
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints i…
-
High 8.7
BuildKit possible race condition with accessing subpaths from cache mounts
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to file…
-
High 8.1
Moby Race Condition vulnerability
moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.
-
High 7.5
moby/moby's dockerd daemon encrypted overlay network may be unauthenticated
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly …
-
Medium 6.8
moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly r…
-
Medium 6.8
moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated
Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly …
-
Medium 6.5
Moby Race Condition vulnerability
moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.
References
-
report
https://ubuntu.com/security/CVE-2023-28840
-
report
https://ubuntu.com/security/CVE-2023-28841
-
report
https://ubuntu.com/security/CVE-2023-28842
-
report
https://ubuntu.com/security/CVE-2024-23651
-
report
https://ubuntu.com/security/CVE-2024-23652
-
report
https://ubuntu.com/security/CVE-2024-36621
-
report
https://ubuntu.com/security/CVE-2024-36623