cve-2024-24557
Vulnerability from cvelistv5
Published
2024-02-01 16:26
Modified
2024-08-01 23:19
Severity ?
6.9 (Medium) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
Summary
Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.
References
security-advisories@github.comhttps://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400aePatch
security-advisories@github.comhttps://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjcVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400aePatch
af854a3a-2127-422b-91ae-364da2661108https://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjcVendor Advisory
Impacted products
Vendor Product Version
moby moby Version: >= 25.0.0, < 25.0.2
Version: < 24.0.9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-01T23:19:52.928Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "https://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc",
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc",
               },
               {
                  name: "https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "moby",
               vendor: "moby",
               versions: [
                  {
                     status: "affected",
                     version: ">= 25.0.0, < 25.0.2",
                  },
                  {
                     status: "affected",
                     version: " < 24.0.9",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "LOW",
                  baseScore: 6.9,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-346",
                     description: "CWE-346: Origin Validation Error",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-345",
                     description: "CWE-345: Insufficient Verification of Data Authenticity",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-02-01T17:38:40.747Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc",
            },
            {
               name: "https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae",
            },
         ],
         source: {
            advisory: "GHSA-xw73-rw38-6vjc",
            discovery: "UNKNOWN",
         },
         title: "Moby classic builder cache poisoning",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2024-24557",
      datePublished: "2024-02-01T16:26:29.685Z",
      dateReserved: "2024-01-25T15:09:40.208Z",
      dateUpdated: "2024-08-01T23:19:52.928Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-24557\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-02-01T17:15:10.953\",\"lastModified\":\"2024-11-21T08:59:24.603\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.\"},{\"lang\":\"es\",\"value\":\"Moby es un proyecto de código abierto creado por Docker para permitir la contenedorización de software. El sistema de caché del constructor clásico es propenso a envenenar el caché si la imagen se crea DESDE scratch. Además, los cambios en algunas instrucciones (las más importantes son HEALTHCHECK y ONBUILD) no provocarían una pérdida de caché. Un atacante con conocimiento del Dockerfile que alguien está usando podría envenenar su caché al obligarlo a extraer una imagen especialmente manipulada que se consideraría como un candidato de caché válido para algunos pasos de compilación. Los usuarios de 23.0+ solo se ven afectados si optaron explícitamente por no participar en Buildkit (variable de entorno DOCKER_BUILDKIT=0) o si están usando el endpoint API /build. Todos los usuarios con versiones anteriores a la 23.0 podrían verse afectados. El punto final de la API de creación de imágenes (/build) y la función ImageBuild de github.com/docker/docker/client también se ven afectados ya que utiliza el generador clásico de forma predeterminada. Los parches se incluyen en las versiones 24.0.9 y 25.0.2.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L\",\"baseScore\":6.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.0,\"impactScore\":5.3},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-345\"},{\"lang\":\"en\",\"value\":\"CWE-346\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-346\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"24.0.9\",\"matchCriteriaId\":\"8334C2EE-69C4-42D5-89C3-00C77A880F08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"25.0.0\",\"versionEndExcluding\":\"25.0.2\",\"matchCriteriaId\":\"D9331CA9-E92E-4D37-8C87-92F6D4418C4A\"}]}]}],\"references\":[{\"url\":\"https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.