Moby v25.0.3 Race Condition Vulnerability Affects Data Corruption and Application Crashes
CVE-2024-36623

8.1HIGH

Key Information:

Vendor

Moby

Status
Moby
Vendor
CVE Published:
29 November 2024

What is CVE-2024-36623?

Moby version 25.0.3 contains a race condition vulnerability located in the streamformatter package. This flaw allows for multiple concurrent write operations, which can lead to unexpected data corruption or crashes within the application. Attackers may exploit this weakness to compromise software integrity and availability, impacting user operations.

References

https://github.com/moby/moby/commit/5689dabfb357b673abdb4...
https://github.com/moby/moby/blob/v25.0.3/pkg/streamforma...
https://gist.github.com/1047524396/c192c0159a19bf58a4373b...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.