6.5

CVE-2024-32473: moby Exposure of Resource to Wrong Sphere

CVSS: 6.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2024-32473DEBIAN-CVE-2024-32473CGA-2h8p-xhcv-g3px
Published 18-04-2024Last modified 21-08-2024
Open JSON

Vulnerability summary

CVE-2024-32473 is a medium (CVSS 6.5) Exposure of Resource to Wrong Sphere vulnerability in moby. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.4% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.35%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 20
CGA-4F5C-G2FQ-XP97CGA-5FM2-396P-87W4CGA-5H7P-WPQM-J5G6CGA-625C-86PG-XXP5CGA-67QJ-7RWX-GJ6QCGA-6JP2-P8M2-PJVX

Timeline

  1. 18-04-2024
    PublishedVulnerability first disclosed.
  2. 21-08-2024
    Last modifiedVulnerability information updated.

Description

Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. In 26.0.0, IPv6 is not disabled on network interfaces, including those belonging to networks where `--ipv6=false`. An container with an `ipvlan` or `macvlan` interface will normally be configured to share an external network link with the host machine. Because of this direct access, (1) Containers may be able to communicate with other hosts on the local network over link-local IPv6 addresses, (2) if router advertisements are being broadcast over the local network, containers may get SLAAC-assigned addresses, and (3) the interface will be a member of IPv6 multicast groups. This means interfaces in IPv4-only networks present an unexpectedly and unnecessarily increased attack surface. The issue is patched in 26.0.2. To completely disable IPv6 in a container, use `--sysctl=net.ipv6.conf.all.disable_ipv6=1` in the `docker create` or `docker run` command. Or, in the service configuration of a `compose` file.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.35%

Chance of exploitation in the next 30 days

Percentile

27%

Versus all other CVEs

30-day change

0.00 pp

From 0.35% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.35%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard25 products
  • buf< 1.31.0-r0
  • cri-tools< 1.30.0-r1
  • crictl< 1.30.0-r1
  • critest< 1.30.0-r1
  • dagger< 0.11.1-r1
Wolfi22 products
  • buf< 1.31.0-r0
  • cri-tools< 1.30.0-r1
  • crictl< 1.30.0-r1
  • critest< 1.30.0-r1
  • dagger< 0.11.1-r1
Debian1 product
  • docker.ioAll versions (No fix recorded) | < 26.1.4+dfsg1-9
Github.com/docker1 product
  • docker≥ 26.0.0, < 26.0.2 | ≥ 26.0.0+incompatible, < 26.0.2+incompatible
Moby1 product
  • moby≥ 26.0.0, < 26.0.2
Mobyproject1 product
  • moby≥ 26.0.0, < 26.0.2
Ubuntu1 product
  • docker.io-app< 26.1.3-0ubuntu1~20.04.1+esm1 | < 27.5.1-0ubuntu3~22.04.2

7 vendors · 52 products

References

8 links