Skip to content
Fencer Vulns
medium 5.9

CVE-2024-29018 json

External DNS requests from 'internal' networks could lead to data exfiltration

published 2024-03-19 2 y ago modified 2026-09-10 59 d ago also EUVD-2024-0966 , GHSA-mq39-4gv4-mvpx , GO-2024-2659

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.

When containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.

Containers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.

In addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.

When a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container's network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.

As a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.

Many systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host's configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.

Because `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.

Docker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.

Moby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container's network namespace.

Patch / fix

  • go github.com/docker/docker 23.0.11, 25.0.5, 25.0.5+incompatible, 26.0.0-rc3, 26.0.0-rc3+incompatible
  • mobyproject moby 23.0.11, 25.0.5, 26.0.0-rc3
  • docker.io Debian 14, Debian 13 26.1.4+dfsg1-9

debian advisories DEBIAN-CVE-2024-29018

  • docker.io-app Ubuntu 22.04 LTS 27.5.1-0ubuntu3~22.04.2
  • docker.io-app Ubuntu 24.04 LTS 27.5.1-0ubuntu3~24.04.2
  • docker.io Ubuntu Pro 16.04 LTS 18.09.7-0ubuntu1~16.04.9+esm2
  • docker.io Ubuntu Pro 18.04 LTS 20.10.21-0ubuntu1~18.04.3+esm2
  • docker.io-app Ubuntu Pro 20.04 LTS 26.1.3-0ubuntu1~20.04.1+esm1
  • docker.io-app Ubuntu Pro 22.04 LTS 26.1.3-0ubuntu1~22.04.1+esm1
  • docker.io-app Ubuntu Pro 24.04 LTS 26.1.3-0ubuntu1~24.04.1+esm1

ubuntu advisories UBUNTU-CVE-2024-29018

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker-stable SLE Module for Containers 15 SP7, openSUSE Leap 15.6 24.0.9_ce-150000.1.39.1
  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 24.0.9_ce-150000.1.25.1
  • docker Linux Micro 6.0 27.5.1_ce-2.1
  • docker Linux Micro 6.1 27.5.1_ce-slfo.1.1_1.1
  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +11 more 24.0.9_ce-150000.1.15.1
  • docker SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +16 more 27.5.1_ce-150000.218.1
  • docker SLE Module for Containers 15 SP6, SLE Micro 5.5, SLE Micro 5.4 +4 more 27.5.1_ce-150000.215.3
  • docker-stable SLE Module for Containers 15 SP6, openSUSE Leap 15.6 24.0.9_ce-150000.1.11.1

suse advisories SUSE-SU-2026:1118-1SUSE-SU-2026:0972-1SUSE-SU-2025:03545-1SUSE-SU-2025:03540-1SUSE-SU-2025:20205-1SUSE-SU-2025:1102-1

  • docker openSUSE Tumbleweed 27.4.1_ce-12.1
  • docker-stable openSUSE Tumbleweed 24.0.9_ce-6.1

opensuse advisories openSUSE-SU-2024:14597-1openSUSE-SU-2024:14598-1

  • docker Alpine 3.18 25.0.2-r0
  • docker Alpine 3.19 25.0.5-r0
  • docker Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 26.0.0-r0

alpine advisories ALPINE-CVE-2024-29018

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • moby-engine Azure Linux 3.0 25.0.3-6
  • moby-engine CBL-Mariner 2.0 24.0.9-9

azure linux advisories AZL-36900AZL-40034

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-29018 updated cvss 5.9

moby: external DNS requests from 'internal' networks could lead to data exfiltration

  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-controller-rhel8 v1.8.4-22
    fixed: vendor fix RHSA-2024:7164
  • Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-waiters-rhel8 Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/jetstack-cert-manager-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9 Red Hat Migration Toolkit for Applications 6 mta/mta-hub-rhel8, mta/mta-windup-addon-rhel8 Red Hat Migration Toolkit for Containers rhmtc/openshift-velero-plugin-rhel8 Red Hat Multicluster Engine for Kubernetes multicluster-engine/agent-service-rhel8, multicluster-engine/assisted-installer-rhel8, multicluster-engine/assisted-installer-agent-rhel8, multicluster-engine/cluster-api-provider-aws-rhel9, multicluster-engine/cluster-api-provider-azure-rhel9
    +29 more products
    Red Hat OpenShift API for Data Protection oadp/oadp-rhel8-operator, oadp/oadp-velero-plugin-rhel8, oadp/oadp-kubevirt-velero-plugin-rhel9 Red Hat OpenShift Developer Tools and Services ocp-tools-4/jenkins-rhel8 Red Hat OpenShift Serverless openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/serving-queue-rhel8 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/prometheus-rhel8, openshift-service-mesh/istio-rhel8-operator Red Hat OpenShift Source-to-Image (S2I) source-to-image-container Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/prometheus-rhel9, rhacm2/submariner-rhel8-operator, rhacm2/multicluster-operators-channel-rhel8, rhacm2/multicluster-operators-subscription-rhel8 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-scanner-rhel8 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-scanner-rhel8 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Ceph Storage 6 rhceph/rhceph-promtail-rhel9, rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 7 rhceph/grafana-rhel9, rhceph/rhceph-promtail-rhel9 Red Hat Enterprise Linux 7 docker, podman, skopeo Red Hat Enterprise Linux 8 podman, skopeo, podman-tests, skopeo-tests, podman-docker, podman-remote, +5 more Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 v1.8.4-10, rhmtc/openshift-migration-openvpn-rhel8 v1.8.4-10, rhmtc/openshift-migration-registry-rhel8 v1.8.4-11, rhmtc/openshift-migration-rhel8-operator v1.8.4-16, rhmtc/openshift-migration-operator-bundle v1.8.4-33, rhmtc/openshift-migration-hook-runner-rhel8 v1.8.4-8, +4 more Red Hat OpenShift Container Platform 3.11 podman, cri-tools, atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, +19 more Red Hat OpenShift Container Platform 4 cri-tools, openshift4/frr-rhel8, openshift4/ose-tests, openshift4/ose-console, openshift4/ose-tools-rhel9, openshift4/ose-contour-rhel8, +28 more Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8, rhai-tech-preview/assisted-installer-agent-rhel8 Red Hat Openshift Container Storage 4 ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/rook-ceph-rhel8-operator Red Hat Openshift Data Foundation 4 odf4/rook-ceph-rhel9-operator, odf4/odf-csi-addons-sidecar-rhel8 Red Hat OpenShift Data Science (RHODS) rhods/odh-ml-pipelines-cache-rhel8 Red Hat OpenShift Dev Spaces devspaces/udi-rhel8, devspaces/traefik-rhel8 Red Hat OpenShift distributed tracing 2 rhosdt/opentelemetry-rhel8-operator, rhosdt/opentelemetry-collector-rhel8 Red Hat OpenShift distributed tracing 3 rhosdt/opentelemetry-rhel8-operator, rhosdt/opentelemetry-collector-rhel8 Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator Red Hat OpenShift Virtualization 4 container-native-virtualization/virt-cdi-cloner, container-native-virtualization/virt-cdi-cloner-rhel9, container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cluster-network-addons-operator-rhel9 Red Hat OpenStack Platform 16.2 osp-director-provisioner-container Red Hat Quay 3 quay/clair-rhel8, quay/quay-builder-rhel8 Red Hat Software Collections source-to-image
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/docker/docker
>=26.0.0-rc1, <26.0.0-rc3
>=25.0.0, <25.0.5
<23.0.11
>=25.0.0+incompatible, <25.0.5+incompatible
>=26.0.0-rc1+incompatible, <26.0.0-rc3+incompatible
26.0.0-rc3
25.0.5
23.0.11
25.0.5+incompatible
26.0.0-rc3+incompatible

Affected products

  • moby moby
  • mobyproject moby

Classification

Weakness
  • CWE-669 Incorrect Resource Transfer Between Spheres
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of moby/moby published their own advisory on GitHub. Reviewed sources take precedence over it.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.