Moby 26.0.0/26.0.1 IPv6 exposure of resource

Summaryinfo

A vulnerability categorized as problematic has been discovered in Moby 26.0.0/26.0.1. This impacts an unknown function of the component IPv6 Handler. Executing a manipulation can lead to exposure of resource. This vulnerability is handled as CVE-2024-32473. It is possible to launch the attack on the local host. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Moby 26.0.0/26.0.1. It has been declared as problematic. This vulnerability affects an unknown functionality of the component IPv6 Handler. The manipulation with an unknown input leads to a exposure of resource vulnerability. The CWE definition for the vulnerability is CWE-668. The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. As an impact it is known to affect confidentiality. CVE summarizes:

Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. In 26.0.0, IPv6 is not disabled on network interfaces, including those belonging to networks where `--ipv6=false`. An container with an `ipvlan` or `macvlan` interface will normally be configured to share an external network link with the host machine. Because of this direct access, (1) Containers may be able to communicate with other hosts on the local network over link-local IPv6 addresses, (2) if router advertisements are being broadcast over the local network, containers may get SLAAC-assigned addresses, and (3) the interface will be a member of IPv6 multicast groups. This means interfaces in IPv4-only networks present an unexpectedly and unnecessarily increased attack surface. The issue is patched in 26.0.2. To completely disable IPv6 in a container, use `--sysctl=net.ipv6.conf.all.disable_ipv6=1` in the `docker create` or `docker run` command. Or, in the service configuration of a `compose` file.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-32473 since 04/12/2024. The exploitation appears to be difficult. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 227933 (Linux Distros Unpatched Vulnerability : CVE-2024-32473), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 26.0.2 eliminates this vulnerability. Applying the patch 7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (227933). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Moby

Version

• 26.0.0
• 26.0.1

License

• open-source

Website

• Product: https://github.com/moby/moby/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion