Mitigation and Technical Details for Recent Docker Vulnerabilities

| | Versions Impacted | |:-----------------------|:--------------------------| | `runc` | <= 1.1.11 | | `BuildKit` | <= 0.12.4 | | `Moby (Docker Engine)` | <= 25.0.1 and <= 24.0.8 | | `Docker Desktop` | <= 4.27.0 | ### What should I do if I’m on an affected version? If you are using affected versions of runc, BuildKit, Moby, or Docker Desktop, make sure to update to the latest versions, linked in the following table: | | Patched Versions | |:-----------------------|:--------------------------| | `runc` | >= [1.1.12](https://github.com/opencontainers/runc/releases/tag/v1.1.12) | | `BuildKit` | >= [0.12.5](https://github.com/moby/buildkit/releases/tag/v0.12.5) | | `Moby (Docker Engine)` | >= [25.0.2](https://github.com/moby/moby/releases/tag/v25.0.2) and >= [24.0.9](https://github.com/moby/moby/releases/tag/v24.0.9) | | `Docker Desktop` | >= [4.27.1](/manuals/desktop/release-notes.md#4271) | If you are unable to update to an unaffected version promptly, follow these best practices to mitigate risk: * Only use trusted Docker images (such as [Docker Official Images](../docker-hub/image-library/trusted-content.md#docker-official-images)). * Don’t build Docker images from untrusted sources or untrusted Dockerfiles. * If you are a Docker Business customer using Docker Desktop and unable to update to v4.27.1, make sure to enable [Hardened Docker Desktop](/manuals/security/for-admins/hardened-desktop/_index.md) features such as: * [Enhanced Container Isolation](/manuals/security/for-admins/hardened-desktop/enhanced-container-isolation/_index.md), which mitigates the impact of CVE-2024-21626 in the case of running containers from malicious images. * [Image Access Management](for-admins/hardened-desktop/image-access-management.md), and [Registry Access Management](/manuals/security/for-admins/hardened-desktop/registry-access-management.md), which give organizations control over which images and repositories their users can access. * For CVE-2024-23650, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, avoid using BuildKit frontend from an untrusted source. A frontend image is usually specified as the #syntax line on your Dockerfile, or with `--frontend` flag when using the `buildctl build` command. * To mitigate CVE-2024-24557, make sure to either use BuildKit or disable caching when building images. From the CLI this can be done via the `DOCKER_BUILDKIT=1` environment variable (default for Moby >= v23.0 if the buildx plugin is installed) or the `--no-cache flag`. If you are using the HTTP API directly or through a client, the same can be done by setting `nocache` to `true` or `version` to `2` for the [/build API endpoint](https://docs.docker.com/engine/api/v1.44/#tag/Image/operation/ImageBuild). ### Technical details and impact #### CVE-2024-21626 (High) In runc v1.1.11 and earlier, due to certain leaked file descriptors, an attacker can gain access to the host filesystem by causing a newly-spawned container process (from `runc exec`) to have a working directory in the host filesystem namespace, or by tricking a user to run a malicious image and allow a container process to gain access to the host filesystem through `runc run`. The attacks can also be adapted to overwrite semi-arbitrary host binaries, allowing for complete container escapes. Note that when using higher-level runtimes (such as Docker or Kubernetes), this vulnerability can be exploited by running a malicious container image without additional configuration or by passing specific workdir options when starting a container. The vulnerability can also be exploited from within Dockerfiles in the case of Docker. _The issue has been fixed in runc v1.1.12._ #### CVE-2024-23651 (High) In BuildKit <= v0.12.4, two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition, leading to files from the host system being accessible to the build container. This will only occur if a user is trying to build a Dockerfile of a malicious project.

This section provides detailed guidance on mitigating recent vulnerabilities affecting runc, BuildKit, Moby, and Docker Desktop. It lists the affected and patched versions for each component and advises users to update to the latest versions. If immediate updates are not possible, it recommends using trusted images, avoiding untrusted sources, and enabling Hardened Docker Desktop features. The section also includes technical details about CVE-2024-21626 (runc) and CVE-2024-23651 (BuildKit), explaining the potential impact and attack vectors.