CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
21.5%
The classic builder cache system is prone to cache poisoning if the image is built FROM scratch
.
Also, changes to some instructions (most important being HEALTHCHECK
and ONBUILD
) would not cause a cache miss.
An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps.
For example, an attacker could create an image that is considered as a valid cache candidate for:
FROM scratch
MAINTAINER Pawel
when in fact the malicious image used as a cache would be an image built from a different Dockerfile.
In the second case, the attacker could for example substitute a different HEALTCHECK
command.
23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0
environment variable) or are using the /build
API endpoint (which uses the classic builder by default).
All users on versions older than 23.0 could be impacted. An example could be a CI with a shared cache, or just a regular Docker user pulling a malicious image due to misspelling/typosquatting.
Image build API endpoint (/build
) and ImageBuild
function from github.com/docker/docker/client
is also affected as it the uses classic builder by default.
Patches are included in Moby releases:
--no-cache
or use Buildkit if possible (DOCKER_BUILDKIT=1
, it’s default on 23.0+ assuming that the buildx plugin is installed).Version = types.BuilderBuildKit
or NoCache = true
in ImageBuildOptions
for ImageBuild
call.github.com/advisories/GHSA-xw73-rw38-6vjc
github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae
github.com/moby/moby/commit/fca702de7f71362c8d103073c7e4a1d0a467fadd
github.com/moby/moby/commit/fce6e0ca9bc000888de3daa157af14fa41fcd0ff
github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc
nvd.nist.gov/vuln/detail/CVE-2024-24557
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
21.5%