Docker Engine docker cp Race Condition Vulnerability (CVE-2024-41568)

Vulnerability Overview A race condition vulnerability exists in the command, allowing malicious containers to create arbitrary empty files or directories on the host file system through symlink swapping. The vulnerability occurs during mount point creation, and the relevant race condition is also tracked during subsequent operations. Impact Scope Affected Versions: - Docker Engine: < 29.5.1 - github.com/docker/docker/daemon (Go): < v28.5.2 - github.com/moby/moby/v2/daemon (Go): < v2.0.0-beta.14 CVSS v3 Base Metrics: - Attack Vector: Local - Attack Complexity: High - User Interaction: Required - Scope: Changed - Confidentiality: None - Integrity: Low - Availability: High CVE ID: CVE-2024-41568 Remediation Patch: - Mount point creation is now restricted to within the container's root directory (Go 1.24+), rejecting symlinks that attempt to escape to open root directories. All file system operations are executed via handles in ( , ). Therefore, even if symlinks are swapped after path resolution, creation remains confined within the container's root directory. Workarounds: - Run containers only from trusted images. - Avoid using with untrusted containers. - Use authorization plugins to restrict access to archive API endpoints ( , ). Exploitation Conditions The container must run a process that can rapidly create and swap symlinks. An operator must initiate a operation to that container, or call the or API endpoints. Unaffected Containers without volume mounts are unaffected, as the race condition occurs during volume bind mount setup. Examples Converting into a directory prevents the daemon from restarting. Creating blocks user login. Overwriting critical system paths with empty files can disrupt services. Summary This vulnerability allows malicious containers to create arbitrary empty files or directories on the host file system, potentially leading to persistent denial of service. It is recommended to upgrade to the patched version as soon as possible or implement the aforementioned workarounds.

Goal Reached Thanks to every supporter — we hit 100%!

Docker Engine docker cp Race Condition Vulnerability (CVE-2024-41568)

More from this source