7.8

CVE-2024-24557: moby

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2024-24557DEBIAN-CVE-2024-24557CGA-27jg-w8cw-wr55
Published 01-02-2024Last modified 15-05-2025
Open JSON

Vulnerability summary

CVE-2024-24557 is a high (CVSS 7.8) vulnerability in moby. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.6% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
0.26%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 105
CGA-22JM-FMJR-77Q6CGA-25CW-M8PG-WXXJCGA-2GPW-4JJJ-6W6PCGA-2RJM-C92X-965XCGA-39VR-GJXJ-CF9RCGA-3CXW-QP9H-MMM7

Showing 100 of 105. Use Open JSON for the complete list.

Timeline

  1. 01-02-2024
    PublishedVulnerability first disclosed.
  2. 15-05-2025
    Last modifiedVulnerability information updated.

Description

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.26%

Chance of exploitation in the next 30 days

Percentile

17%

Versus all other CVEs

30-day change

0.00 pp

From 0.26% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.26%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard109 products
  • aactl< 0.4.12-r8
  • argo-workflows< 3.5.5-r4
  • argo-workflows-fips< 3.5.5-r3
  • bom< 0.6.0-r4
  • buildkitd< 0.13.1-r2
Wolfi87 products
  • aactl< 0.4.12-r8
  • argo-workflows< 3.5.5-r4
  • bom< 0.6.0-r4
  • buildkitd< 0.13.1-r2
  • cadvisor< 0.49.1-r4
Ubuntu2 products
  • docker.ioAll versions (No fix recorded)
  • docker.io-app< 26.1.3-0ubuntu1~20.04.1+esm1 | < 27.5.1-0ubuntu3~22.04.2 | < 27.5.1-0ubuntu3~24.04.2
Debian1 product
  • docker.ioAll versions (No fix recorded) | < 26.1.4+dfsg1-9
Github.com/docker1 product
  • docker< 24.0.9 | ≥ 25.0.0, < 25.0.2 | ≥ 25.0.0+incompatible, < 25.0.2+incompatible

5 vendors · 200 products · Showing 200 of 204. Use Open JSON for the complete list.

References

11 links
Show all 11 references