CVE-2024-36623: mobyproject moby

Analyzed

AliasesUBUNTU-CVE-2024-36623DEBIAN-CVE-2024-36623CGA-273v-2wxq-g89h+198 more

Published 29-11-2024Last modified 01-05-2025

Vulnerability summary

CVE-2024-36623 is a high (CVSS 8.1) vulnerability in mobyproject moby. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 50.8% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 8.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

8.1/10

010

High · v3.1 (CVE.org)

EPSS score

0.64%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 14

OPENSUSE-SU-2024:14567-1 USN-7474-1 CGA-4WCW-F4CG-C962 CGA-5R35-PRQW-CQQP CGA-8RRR-C2RX-Q876 CGA-C44C-87GQ-886C+8 more

Timeline

29-11-2024
PublishedVulnerability first disclosed.
01-05-2025
Last modifiedVulnerability information updated.

Description

moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.

CVSS metrics

8 scores · 7 sources · 2 versions

v4.08.7v3.18.1

EPSS trend

Probability

0.64%

Chance of exploitation in the next 30 days

Percentile

51%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.64% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard95 products

amazon-cloudwatch-agent-operator< 3.5.0-r0
amazon-cloudwatch-agent-operator-fips< 3.5.0-r0
amazon-ecs-agent< 1.99.0-r0
amazon-ecs-agent-fips< 1.99.0-r0
cluster-api-1.7-capd-managerAll versions (No fix recorded)

cluster-api-fips-1.7-capd-managerAll versions (No fix recorded)
docker-machine-driver-harvesterAll versions (No fix recorded)
gitlab-docker-machine-18.6All versions (No fix recorded)
gitlab-docker-machine-fips-18.6All versions (No fix recorded)
gitlab-runner-18.6All versions (No fix recorded)
gitlab-runner-fips-18.6All versions (No fix recorded)
gitlab-runner-helper-18.6All versions (No fix recorded)
gitlab-runner-helper-compat-18.6All versions (No fix recorded)
gitlab-runner-helper-compat-fips-18.6All versions (No fix recorded)
gitlab-runner-helper-fips-18.6All versions (No fix recorded)
gitlab-runner-helper-oci-entrypoint-18.6All versions (No fix recorded)
gitlab-runner-helper-oci-entrypoint-fips-18.6All versions (No fix recorded)
gitlab-runner-oci-entrypoint-18.6All versions (No fix recorded)
gitlab-runner-oci-entrypoint-fips-18.6All versions (No fix recorded)
harvester< 1.8.1-r2
harvester-fips< 1.8.1-r11
harvester-fips-webhook< 1.8.1-r11
harvester-webhook< 1.8.1-r2
k3sAll versions (No fix recorded)
k3s-1.31All versions (No fix recorded)
k3s-1.32All versions (No fix recorded)
k3s-1.33< 1.33.10.1-r5
k3s-1.34All versions (No fix recorded)
k3s-1.35All versions (No fix recorded)
k3s-1.36All versions (No fix recorded)
k3s-1.37All versions (No fix recorded)
k3s-fips-1.33All versions (No fix recorded)
k3s-fips-1.34All versions (No fix recorded)
k3s-fips-1.35All versions (No fix recorded)
k3s-fips-1.36All versions (No fix recorded)
k3s-fips-1.37All versions (No fix recorded)
k3s-multicall-1.31All versions (No fix recorded)
k3s-multicall-1.32All versions (No fix recorded)
k3s-multicall-1.33< 1.33.5.1-r2
k3s-staticAll versions (No fix recorded)
k3s-static-1.31All versions (No fix recorded)
k3s-static-1.32All versions (No fix recorded)
k3s-static-1.33< 1.33.10.1-r5
k3s-static-1.34All versions (No fix recorded)
k3s-static-1.35All versions (No fix recorded)
k3s-static-1.36All versions (No fix recorded)
k3s-static-1.37All versions (No fix recorded)
kubevela< 1.9.13-r2
kubevela-vela-cli< 1.9.13-r2
kubevela-vela-core< 1.9.13-r2
kubevela-vela-core-compat< 1.9.13-r2
kubevirt-cdi-uploadserver-1.5< 1.59.2-r5
kubevirt-cdi-uploadserver-fips-1.5All versions (No fix recorded)
loki-2.9All versions (No fix recorded)
loki-2.9-logcliAll versions (No fix recorded)
loki-2.9-loki-canaryAll versions (No fix recorded)
loki-2.9-promtailAll versions (No fix recorded)
loki-fips-2.9All versions (No fix recorded)
loki-fips-2.9-logcliAll versions (No fix recorded)
loki-fips-2.9-loki-canaryAll versions (No fix recorded)
loki-fips-2.9-promtailAll versions (No fix recorded)
prometheus-2.51< 2.51.2-r48
promxy< 0.0.94-r0
promxy-fipsAll versions (No fix recorded)
pulumi< 3.142.0-r1
pulumi-language-go< 3.142.0-r1
pulumi-language-nodejs< 3.142.0-r1
pulumi-language-python< 3.142.0-r1
py3-dockerAll versions (No fix recorded)
py3.10-dockerAll versions (No fix recorded)
py3.11-dockerAll versions (No fix recorded)
py3.12-dockerAll versions (No fix recorded)
py3.13-dockerAll versions (No fix recorded)
rancher-2.10< 2.10.10-r3 | < 2.10.11-r5
rancher-2.11All versions (No fix recorded)
rancher-2.12< 2.12.1-r0
rancher-agent-2.10All versions (No fix recorded)
rancher-agent-2.11All versions (No fix recorded)
rancher-agent-2.12All versions (No fix recorded)
rancher-agent-2.13All versions (No fix recorded)
rancher-agent-2.14< 2.14.3-r0
rancher-agent-2.9All versions (No fix recorded)
rancher-machineAll versions (No fix recorded)
rke2-runtime-1.31All versions (No fix recorded)
rke2-runtime-1.32All versions (No fix recorded)
rke2-runtime-1.33< 1.33.13.2.1-r1
rke2-runtime-1.34< 1.34.2.2.1-r4
rke2-runtime-1.34-charts< 1.34.2.2.1-r4
rke2-runtime-1.35< 1.35.6.2.1-r1
rke2-runtime-1.36< 1.36.2.2.1-r1
rke2-runtime-1.37< 1.37.0.2.1-r2
rke2-runtime-fips-1.31All versions (No fix recorded)
rke2-runtime-fips-1.32All versions (No fix recorded)
vault-1.16< 1.16.3-r44
vault-1.17All versions (No fix recorded)

Show all 95

Wolfi41 products

amazon-cloudwatch-agent-operator< 3.5.0-r0
docker-machine-driver-harvesterAll versions (No fix recorded)
gitlab-docker-machine-18.6All versions (No fix recorded)
gitlab-runner-18.6All versions (No fix recorded)
gitlab-runner-helper-18.6All versions (No fix recorded)

Show all 41

Ubuntu2 products

docker.ioAll versions (No fix recorded) | < 20.10.21-0ubuntu1~18.04.3+esm3 | < 20.10.21-0ubuntu1~20.04.6+esm2 | < 20.10.21-0ubuntu1~22.04.7+esm2 | < 20.10.25+dfsg1-2ubuntu1+esm2
docker.io-app< 26.1.3-0ubuntu1~20.04.1+esm1 | < 27.5.1-0ubuntu3~22.04.2 | < 27.5.1-0ubuntu3~24.04.2

Debian1 product

docker.ioAll versions (No fix recorded) | < 26.1.4+dfsg1-9

Github.com/moby1 product

moby< 25.0.4 | < 26.0.0+incompatible

Mobyproject1 product

moby≤ 25.0.3

6 vendors · 141 products

References

12 links

github.com/moby/moby/commit/5689dabfb357b673abdb4391eef426f297d7d1bbREPORTFIXWEBPatch
github.com/moby/moby/blob/v25.0.3/pkg/streamformatter/streamformatter.goWEBProduct
gist.github.com/1047524396/c192c0159a19bf58a4373b696467dc29WEBThird Party Advisory
github.com/moby/moby/commit/8e3bcf19748838b30e34d612832d1dc9d90363b8FIXWEBPatch
ubuntu.com/security/CVE-2024-36623REPORT
www.cve.org/CVERecord?id=CVE-2024-36623REPORT
ubuntu.com/security/notices/USN-7474-1Advisory
security-tracker.debian.org/tracker/CVE-2024-36623Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36623.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2024-36623AdvisoryOval

Show all 12 references

github.com/moby/mobyPACKAGE
github.com/advisories/GHSA-gh5c-3h97-2f3qAdvisory