Gentoo update for Docker

1) Improper Preservation of Permissions

EUVDB-ID: #VU64415

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:U/U:Clear]

CVE-ID: CVE-2021-41089

CWE-ID: CWE-281 - Improper preservation of permissions

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions, which leads to security restrictions bypass and privilege escalation.

Mitigation

Update the affected packages.
app-containers/docker to version: 25.0.4

Vulnerable software versions

Gentoo Linux: All versions

app-containers/docker: before 25.0.4

CPE2.3

External links

https://security.gentoo.org/glsa/202409-29

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Preservation of Permissions

EUVDB-ID: #VU64416

Risk: Low

CVSSv4.0: 1.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/U:Clear]

CVE-ID: CVE-2021-41091

CWE-ID: CWE-281 - Improper preservation of permissions

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions, which leads to security restrictions bypass and privilege escalation.

Mitigation

Update the affected packages.
app-containers/docker to version: 25.0.4

Vulnerable software versions

Gentoo Linux: All versions

app-containers/docker: before 25.0.4

CPE2.3

External links

https://security.gentoo.org/glsa/202409-29

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Improper Privilege Management

EUVDB-ID: #VU72321

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-36109

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper privilege management caused by improper setup of supplementary groups. A local user can bypass primary group restrictions and compromise the container.

Mitigation

Update the affected packages.
app-containers/docker to version: 25.0.4

Vulnerable software versions

Gentoo Linux: All versions

app-containers/docker: before 25.0.4

CPE2.3

External links

https://security.gentoo.org/glsa/202409-29

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Allocation of Resources Without Limits or Throttling

EUVDB-ID: #VU70334

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2022-41717

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to excessive memory growth when handling HTTP/2 server requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

Mitigation

Update the affected packages.
app-containers/docker to version: 25.0.4

Vulnerable software versions

Gentoo Linux: All versions

app-containers/docker: before 25.0.4

CPE2.3

External links

https://security.gentoo.org/glsa/202409-29

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Insufficiently protected credentials

EUVDB-ID: #VU74150

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-26054

CWE-ID: CWE-522 - Insufficiently Protected Credentials

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to BuildKit may expose sensitive information when the user sends a build request that contains a Git URL with credentials and the build creates a provenance attestation describing that build. A remote attacker can gain access to sensitive information.

Mitigation

Update the affected packages.
app-containers/docker to version: 25.0.4

Vulnerable software versions

Gentoo Linux: All versions

app-containers/docker: before 25.0.4

CPE2.3

External links

https://security.gentoo.org/glsa/202409-29

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Unprotected Alternate Channel

EUVDB-ID: #VU74468

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28840

CWE-ID: CWE-420 - Unprotected Alternate Channel

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to unprotected alternate channel within encrypted overlay networks. A remote attacker can inject arbitrary Ethernet frames into the encrypted overlay network and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
app-containers/docker to version: 25.0.4

Vulnerable software versions

Gentoo Linux: All versions

app-containers/docker: before 25.0.4

CPE2.3

External links

https://security.gentoo.org/glsa/202409-29

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Missing Encryption of Sensitive Data

EUVDB-ID: #VU74467

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28841

CWE-ID: CWE-311 - Missing Encryption of Sensitive Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to missing encryption of sensitive data within the overlay network driver. A remote attacker can gain unauthorized access to sensitive information on the system.

Mitigation

Update the affected packages.
app-containers/docker to version: 25.0.4

Vulnerable software versions

Gentoo Linux: All versions

app-containers/docker: before 25.0.4

CPE2.3

External links

https://security.gentoo.org/glsa/202409-29

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Unprotected Alternate Channel

EUVDB-ID: #VU74469

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28842

CWE-ID: CWE-420 - Unprotected Alternate Channel

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to unprotected alternate channel within encrypted overlay networks. A remote attacker can inject arbitrary Ethernet frames into the encrypted overlay network by encapsulating them in VXLAN datagrams.

Mitigation

Update the affected packages.
app-containers/docker to version: 25.0.4

Vulnerable software versions

Gentoo Linux: All versions

app-containers/docker: before 25.0.4

CPE2.3

External links

https://security.gentoo.org/glsa/202409-29

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper Check for Unusual or Exceptional Conditions

EUVDB-ID: #VU86039

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-23650

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling. A remote attacker can send specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
app-containers/docker to version: 25.0.4

Vulnerable software versions

Gentoo Linux: All versions

app-containers/docker: before 25.0.4

CPE2.3

External links

https://security.gentoo.org/glsa/202409-29

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Race condition

EUVDB-ID: #VU86035

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-23651

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a race condition. A remote attacker can exploit the race and cause the files from the host system being accessible to the build container.

Mitigation

Update the affected packages.
app-containers/docker to version: 25.0.4

Vulnerable software versions

Gentoo Linux: All versions

app-containers/docker: before 25.0.4

CPE2.3

External links

https://security.gentoo.org/glsa/202409-29

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Path traversal

EUVDB-ID: #VU86037

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-23652

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within BuildKit frontend or Dockerfile using RUN --mount. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Mitigation

Update the affected packages.
app-containers/docker to version: 25.0.4

Vulnerable software versions

Gentoo Linux: All versions

app-containers/docker: before 25.0.4

CPE2.3

External links

https://security.gentoo.org/glsa/202409-29

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Incorrect authorization

EUVDB-ID: #VU86038

Risk: High

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2024-23653

CWE-ID: CWE-863 - Incorrect Authorization

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to interactive containers API does not validate entitlements check. A remote attacker can use these APIs to ask BuildKit to run a container with elevated privileges.

Mitigation

Update the affected packages.
app-containers/docker to version: 25.0.4

Vulnerable software versions

Gentoo Linux: All versions

app-containers/docker: before 25.0.4

CPE2.3

External links

https://security.gentoo.org/glsa/202409-29

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

13) Insufficient verification of data authenticity

EUVDB-ID: #VU86049

Risk: Medium

CVSSv4.0: 2.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-24557

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient verification of data authenticity. A remote attacker can poison victim´s cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps.

Mitigation

Update the affected packages.
app-containers/docker to version: 25.0.4

Vulnerable software versions

Gentoo Linux: All versions

app-containers/docker: before 25.0.4

CPE2.3

External links

https://security.gentoo.org/glsa/202409-29

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	13
CVE-ID	CVE-2021-41089 CVE-2021-41091 CVE-2022-36109 CVE-2022-41717 CVE-2023-26054 CVE-2023-28840 CVE-2023-28841 CVE-2023-28842 CVE-2024-23650 CVE-2024-23651 CVE-2024-23652 CVE-2024-23653 CVE-2024-24557
CWE-ID	CWE-281 CWE-269 CWE-770 CWE-522 CWE-420 CWE-311 CWE-754 CWE-362 CWE-22 CWE-863 CWE-345
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #2 is available. Public exploit code for vulnerability #4 is available. Public exploit code for vulnerability #12 is available.
Vulnerable software	Gentoo Linux Operating systems & Components / Operating system app-containers/docker Operating systems & Components / Operating system package or component
Vendor	Gentoo