CVE-2024-24557
Mobyproject
CVE-2024-24557 is a cache poisoning vulnerability in Moby, Docker's open-source containerization project. This flaw allows an attacker to potentially inject malicious code into the Docker image build process. The SVRS score is 70, indicating a significant threat that warrants review.
The vulnerability stems from how the classic builder cache system handles images built FROM scratch and how changes to instructions like HEALTHCHECK and ONBUILD are cached. An attacker who knows the Dockerfile being used can craft a malicious image that appears to be a valid cache candidate, leading to the inclusion of unintended code. This could compromise the security and integrity of applications built using the affected Docker images. Versions before 23.0 are vulnerable, while 23.0+ users are only affected if Buildkit is disabled. Patches are available in versions 24.0.9 and 25.0.2. Given that the CVE is tagged "In The Wild," organizations using Docker should upgrade to the patched versions immediately to mitigate the risk of exploitation and prevent potential supply chain attacks.
Description
CVE-2024-24557 affects Moby, an open-source project created by Docker, and specifically targets the classic builder cache system used in Docker image building. This vulnerability allows an attacker to manipulate the cache system through specially crafted images, potentially leading to the execution of malicious code or unauthorized access to sensitive information.
The SVRS score for this CVE is 70, indicating a high level of vulnerability requiring immediate attention.
Key Insights
- Cache Poisoning: The vulnerability exploits a weakness in the classic builder cache system, allowing attackers to poison the cache with malicious images. This can result in the execution of unauthorized code or the injection of backdoors into built images.
- Impact on Image Building: Both the Image build API endpoint (/build) and the ImageBuild function from the Docker client are vulnerable. This vulnerability affects users who are using the classic builder, either by explicitly opting out of Buildkit or using older versions of Docker.
- Active Exploitation: This vulnerability is classified as "In The Wild", meaning that malicious actors are actively exploiting it.
- Wide Applicability: This vulnerability potentially affects a vast number of Docker users, particularly those who build their images from scratch or utilize the classic builder system.
Mitigation Strategies
- Upgrade Docker: Users should immediately upgrade to Docker version 24.0.9 or 25.0.2 or later, which contain patches for this vulnerability.
- Enable Buildkit: For Docker versions 23.0 or later, users are advised to enable Buildkit by setting the
DOCKER_BUILDKIT=1environment variable. This will bypass the vulnerable classic builder system. - Image Scanning: Implement robust image scanning solutions to detect malicious code or backdoors in images before deployment.
- Security Best Practices: Regularly review and update container security policies, ensure secure image building practices, and implement strong access control measures to mitigate risks.
Additional Information: If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.