Moby IPv6 enabled on IPv4-only network interfaces

CVE-2024-32473

Summary

The Moby container framework, a core aspect of Docker technology, exhibits a network vulnerability stemming from improper IPv6 management in version 26.0.0. When using container interfaces like 'ipvlan' and 'macvlan', communication with other local network devices via link-local IPv6 addresses is possible, leading to increased attack vectors. Rogue SLAAC-assigned addresses can also be allocated if router advertisements are visible in the local environment. This scenario exposes IPv4-only networks inadvertently, as containers become part of IPv6 multicast groups. Users are advised to upgrade to version 26.0.2 for a patch or implement specific commands to disable IPv6 in their configurations.

References