Skip to content
Fencer Vulns
medium 6.9

CVE-2024-24557 json

Moby classic builder cache poisoning

published 2024-02-01 2 y ago modified 2026-09-10 59 d ago also EUVD-2024-0773 , GHSA-xw73-rw38-6vjc , GO-2024-2512

cvss
6.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits
0
none known

Summary

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

Patch / fix

  • go github.com/docker/docker 24.0.9, 24.0.9+incompatible, 25.0.2, 25.0.2+incompatible
  • go github.com/moby/moby 24.0.9, 24.0.9+incompatible, 25.0.2, 25.0.2+incompatible
  • mobyproject moby 24.0.9, 25.0.2
  • docker.io Debian 14, Debian 13 26.1.4+dfsg1-9

debian advisories DEBIAN-CVE-2024-24557

  • docker.io-app Ubuntu 22.04 LTS 27.5.1-0ubuntu3~22.04.2
  • docker.io-app Ubuntu 24.04 LTS 27.5.1-0ubuntu3~24.04.2
  • docker.io-app Ubuntu Pro 20.04 LTS 26.1.3-0ubuntu1~20.04.1+esm1

ubuntu advisories UBUNTU-CVE-2024-24557

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • forgejo-runner openSUSE Tumbleweed 3.5.1-1.1

opensuse advisories openSUSE-SU-2024:14287-1

  • docker Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 25.0.2-r0

alpine advisories ALPINE-CVE-2024-24557

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • moby-engine CBL-Mariner 2.0 20.10.27-3
  • moby-engine Azure Linux 3.0 25.0.3-1

azure linux advisories AZL-34275AZL-35002

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-24557 updated cvss 6.9

moby: classic builder cache poisoning

  • Red Hat Ceph Storage 6 rhceph/rhceph-6-dashboard-rhel9
    affected: no fix available
  • Red Hat Ceph Storage 7.1 Tools rhceph/grafana-rhel9 11.5.2-5, rhceph/rhceph-promtail-rhel9 v3.0.0-33
    fixed: vendor fix RHSA-2025:9340
  • Red Hat Ceph Storage 8.1 Tools rhceph/grafana-rhel9 11.6.2-4
    fixed: vendor fix RHSA-2025:11749
  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator Red Hat Ceph Storage 7.1 Tools rhceph/rhceph-7-rhel9 7-529, rhceph/keepalived-rhel9 2.2.8-64, rhceph/snmp-notifier-rhel9 1.2.1-114, rhceph/rhceph-haproxy-rhel9 2.4.22-66 Red Hat Ceph Storage 8.1 Tools rhceph/rhceph-8-rhel9 8-511, rhceph/keepalived-rhel9 2.2.8-73, rhceph/oauth2-proxy-rhel9 v7.6.0-33, rhceph/snmp-notifier-rhel9 1.2.1-123, rhceph/rhceph-haproxy-rhel9 2.4.22-75, rhceph/rhceph-promtail-rhel9 v3.0.0-40 Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-agent-installer-api-server-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
17 mo ago

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
GitHub 3.1 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/docker/docker
<24.0.9
>=25.0.0, <25.0.2
<24.0.9+incompatible
>=25.0.0+incompatible, <25.0.2+incompatible
24.0.9
25.0.2
24.0.9+incompatible
25.0.2+incompatible
go github.com/moby/moby
<24.0.9
>=25.0.0, <25.0.2
<24.0.9+incompatible
>=25.0.0+incompatible, <25.0.2+incompatible
24.0.9
25.0.2
24.0.9+incompatible
25.0.2+incompatible

Affected products

  • moby moby

Classification

Weakness
  • CWE-346 Origin Validation Error
  • CWE-345 Insufficient Verification of Data Authenticity
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of moby/moby published their own advisory on GitHub. Reviewed sources take precedence over it.