CVE-2024-36623
Aliases:GHSA-gh5c-3h97-2f3qGO-2024-3305DEBIAN-CVE-2024-36623CGA-273v-2wxq-g89hCGA-2g8x-hpx5-r33fCGA-2hwh-53vp-rvvqCGA-2rrf-677m-w8m5CGA-2v67-8p54-86h3CGA-2v7v-q8g3-q496CGA-2vr4-87v4-wwfhCGA-2wgm-35jf-xr3xCGA-2xp6-f67v-pqfwCGA-37j8-vh2x-frvjCGA-3876-5xww-p7vjCGA-3fx9-f9qm-w9f8CGA-3x6p-jmjf-xgw3CGA-47w3-j2xv-45r8CGA-48jc-2p6r-ggqqCGA-4wq3-m2gv-64cgCGA-4x8c-rwg9-7p99CGA-5227-v375-843jCGA-52p3-jw32-4rmvCGA-5fpj-v9rg-hpccCGA-5hfv-554v-wmr8CGA-5j7m-82g9-3prhCGA-627v-x3q2-hvjxCGA-6r8w-q92w-79x7CGA-6rrm-3fpc-pvjxCGA-766h-wgvw-c72hCGA-7g3c-xx5x-c44hCGA-7www-xg2m-wvwpCGA-85wf-m9xh-qmh3CGA-8crj-jgvf-cx9fCGA-9rxr-qx7r-g4wqCGA-c95m-hvpj-r8m6CGA-c9xc-3cgx-2843CGA-cjq3-wgxq-vmm4CGA-cr35-688f-5885CGA-f34f-m329-96v5CGA-f5f7-rwg4-7mrpCGA-f5x5-9323-7jhhCGA-f77q-hgjp-cw5qCGA-fjr9-j8pj-f75cCGA-fjrh-hhm8-3pj4CGA-gqrr-g58g-vq67CGA-gvhw-g8v3-p7hvCGA-hjr8-mcwm-gh8mCGA-hv54-rr48-4jfvCGA-j6h5-v8jj-95chCGA-jchv-xmph-xjm7CGA-jf92-4pp7-xfc6CGA-jhjp-299h-5686CGA-m983-prwq-qpcmCGA-mc25-mrjx-q3p3CGA-mhpw-54vm-5288CGA-mw8g-mrx5-p7xhCGA-p5f2-g5r9-4367CGA-p5qq-88cr-3mwjCGA-p5rp-435f-738vCGA-2f7j-648j-9r55CGA-2g2h-x72q-r9hfCGA-2qh5-ph97-c46pCGA-2vfq-mvv6-vvf7CGA-377p-wj7r-jfx5CGA-37rx-32fr-j47fCGA-3c35-c5m4-43v3CGA-3f89-584x-m3qgCGA-3jj7-86x5-4xxwCGA-3p97-587q-p6j6CGA-438f-c4v9-rmfqCGA-439r-43mh-g3jgCGA-4g6w-9ff5-8hmfCGA-4jv3-hgpr-53f3CGA-522j-gxcf-vvc8CGA-5f64-rjg7-87pfCGA-5hhr-384v-r35jCGA-5vxg-4mqx-2gx8CGA-6f79-572q-36p2CGA-6hw5-9cpg-v32wCGA-6ph3-6h9g-mxf9CGA-78fj-r5fw-g27xCGA-7ff6-wmrh-m3frCGA-7g7v-q52m-ggx2CGA-7h2p-q6hf-2q42CGA-7vj5-qwwf-whhjCGA-7w3f-65f7-4pqvCGA-846j-6498-2vf5CGA-84r3-wv4c-f8mgCGA-866w-2h6h-8mmgCGA-8g4m-wxxv-256jCGA-8mrq-r63m-2jv5CGA-8p3q-m6vj-jw6pCGA-8r3r-4xxh-g89cCGA-8w7c-pf4j-34q8CGA-94j8-vc37-qq72CGA-97hp-wc2g-m4q5CGA-98wh-6vv6-2p63CGA-9cvj-29rq-4jvhCGA-9v99-rxqh-q55qCGA-c3p8-54hg-54jqCGA-cx6v-f6hc-h4c8CGA-f2g7-wwfq-33r6CGA-f48f-j42h-hmx5CGA-f5v7-j3gh-xg6rCGA-f6cg-5j88-m56jCGA-f75h-xhvg-4q6fCGA-fpw6-h838-88jpCGA-g645-2fx8-789jCGA-g6mh-9gvc-7cjgCGA-g8x4-rgmj-rwc8CGA-g97r-rg7r-xmj8CGA-gmr5-qr48-64jqCGA-h8w8-4qmm-f96wCGA-hc3f-mjch-59f2CGA-hcrr-v7p9-87qmCGA-hfwc-552x-v5wgCGA-hg7c-73hh-3x74CGA-hwjg-gj3j-9x6mCGA-hxv3-c9xp-v6g5CGA-j755-hmcg-7vf4CGA-j8gg-8mpf-crq7CGA-j8j7-3mx6-74wrCGA-jf83-6433-j9hvCGA-jh2h-cw43-vwq4CGA-jq66-fj4r-g6j3CGA-m8qg-hh4g-cmc3CGA-mwcv-8h6c-5q8xCGA-p22p-v759-x543CGA-p92w-m8vv-4466CGA-pc44-4vc6-xh5mCGA-pjvj-j467-6pfwCGA-pv9q-2q49-4gj7CGA-pwpx-mp4r-r558CGA-q3mj-gh2r-6pffCGA-q4cf-jhjw-w8f9CGA-qchf-64x7-mq68CGA-qf63-f38v-5mj9CGA-qgfm-p84c-8826CGA-qgw4-979g-39vpCGA-qjc7-5jpp-xwg8CGA-qjmw-5pfm-5h88CGA-qp86-8gx7-q594CGA-qx26-2v2m-hq66CGA-r249-j7m2-c8h7CGA-r3c3-f47g-vxrxCGA-r4jq-69qc-vwhpCGA-r75c-x9qq-h39mCGA-rc46-36wg-wc7jCGA-rfqh-xrmj-8gw2CGA-rhqv-cp3r-5534CGA-rp67-vvxg-fg8qCGA-rq5c-xjqg-x84xCGA-rrwq-m2vg-2fc6CGA-rv23-wmw4-c3vqCGA-rxh9-gh6f-86ggCGA-rxxh-pvv8-m933CGA-v5jv-47xg-22p5CGA-v7vg-6px9-f74jCGA-v968-5xff-rr64CGA-v9jm-8g5r-wq97CGA-vcq9-wc9p-4qj5CGA-vf6h-vw3j-86wqCGA-vjrp-v34w-v73mCGA-vm94-3m2x-x6m7CGA-vmrx-4r42-v8c6CGA-vwwp-j4g3-ww4xCGA-w322-whjg-6qp8CGA-wccr-hwx6-6747CGA-wm53-8728-5hr7CGA-wq8c-798h-vr4fCGA-wxv6-3xw4-cjv3CGA-x5p5-89qp-qj27CGA-x6fr-f9vg-m84pCGA-x6mp-gc9q-6jjmCGA-x832-969j-fjw5CGA-xc4m-6qp8-r7cpCGA-xm9p-2cvh-3cwvCGA-xmcx-27gc-c5cjCGA-xx4h-h3jv-xfxfCGA-xx7m-rh8h-48v6CGA-8vqj-36m8-4vw4CGA-c4r4-pwxp-hjc6
Advisory lineage Upstream: 0 Downstream: 4
Analyzed
Published: 29 Nov 2024, 00:00
Last modified:01 May 2025, 13:48
Vulnerability Summary
Overall Risk (default)
medium
33/100 CVSS Score
8.1 HIGH
v3.1 (cve.org)
EPSS Score
0.64% LOW
1% probability +0.59%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
29 Nov 2024, 00:00
Published
Vulnerability first disclosed
01 May 2025, 13:48
Last Modified
Vulnerability information updated
Description
moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.
CVSS Metrics
- v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS Trends
Current EPSS score: 0.64%• Percentile: 49%
Techniques & Countermeasures
- CWE-362•Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Affected Systems
- chainguard•amazon-cloudwatch-agent-operator
< 3.5.0-r0
- chainguard•amazon-cloudwatch-agent-operator-fips
< 3.5.0-r0
- chainguard•amazon-ecs-agent
< 1.99.0-r0
- chainguard•amazon-ecs-agent-fips
< 1.99.0-r0
- chainguard•cluster-api-1.7-capd-manager
all
- chainguard•cluster-api-fips-1.7-capd-manager
all
- chainguard•docker-machine-driver-harvester
< 0
- chainguard•gitlab-docker-machine-18.6
< 0
- chainguard•gitlab-docker-machine-fips-18.6
< 0
- chainguard•gitlab-runner-18.6
< 0
- chainguard•gitlab-runner-fips-18.6
< 0
- chainguard•gitlab-runner-helper-18.6
< 0
- chainguard•gitlab-runner-helper-compat-18.6
< 0
- chainguard•gitlab-runner-helper-compat-fips-18.6
< 0
- chainguard•gitlab-runner-helper-fips-18.6
< 0
- chainguard•gitlab-runner-helper-oci-entrypoint-18.6
< 0
- chainguard•gitlab-runner-helper-oci-entrypoint-fips-18.6
< 0
- chainguard•gitlab-runner-oci-entrypoint-18.6
< 0
- chainguard•gitlab-runner-oci-entrypoint-fips-18.6
< 0
- chainguard•harvester
< 1.8.1-r2
- chainguard•harvester-fips
< 1.8.1-r11
- chainguard•harvester-fips-webhook
< 1.8.1-r11
- chainguard•harvester-webhook
< 1.8.1-r2
- chainguard•k3s
< 0
- chainguard•k3s-1.31
< 0
- chainguard•k3s-1.32
< 0
- chainguard•k3s-1.33
< 1.33.10.1-r5
- chainguard•k3s-1.34
< 0
- chainguard•k3s-1.35
< 0
- chainguard•k3s-multicall-1.31
< 0
- chainguard•k3s-multicall-1.32
< 0
- chainguard•k3s-multicall-1.33
< 1.33.5.1-r2
- chainguard•k3s-static
< 0
- chainguard•k3s-static-1.31
< 0
- chainguard•k3s-static-1.32
< 0
- chainguard•k3s-static-1.33
< 1.33.10.1-r5
- chainguard•k3s-static-1.34
< 0
- chainguard•k3s-static-1.35
< 0
- chainguard•kubevela
< 1.9.13-r2
- chainguard•kubevela-vela-cli
< 1.9.13-r2
- chainguard•kubevela-vela-core
< 1.9.13-r2
- chainguard•kubevela-vela-core-compat
< 1.9.13-r2
- chainguard•kubevirt-cdi-uploadserver-1.5
< 1.59.2-r5
- chainguard•kubevirt-cdi-uploadserver-fips-1.5
< 0
- chainguard•loki-2.9
< 0
- chainguard•loki-2.9-logcli
< 0
- chainguard•loki-2.9-loki-canary
< 0
- chainguard•loki-2.9-promtail
< 0
- chainguard•loki-fips-2.9
< 0
- chainguard•loki-fips-2.9-logcli
< 0
Showing first 50 affected entries in server-rendered view.
References (9)
- https://github.com/moby/moby/commit/5689dabfb357b673abdb4391eef426f297d7d1bb
- https://github.com/moby/moby/blob/v25.0.3/pkg/streamformatter/streamformatter.go#L115
- https://gist.github.com/1047524396/c192c0159a19bf58a4373b696467dc29
- https://github.com/moby/moby/commit/8e3bcf19748838b30e34d612832d1dc9d90363b8
- https://nvd.nist.gov/vuln/detail/CVE-2024-36623
- https://github.com/moby/moby
- https://github.com/advisories/GHSA-gh5c-3h97-2f3q
- https://security-tracker.debian.org/tracker/CVE-2024-36623
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36623.json