TI-2024-16178 Aliases CVE-2024-24557 GHSA-xw73-rw38-6vjc

Moby classic builder cache poisoning

LOW 34CWE-345Published 2024-02-01 · Updated 2025-05-15

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-345.

Summary

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0026 17th percentileScored 2026-11-07

Fix Partial moby (moby): 25.0.2, 24.0.9github.com/docker/docker (Go): 24.0.9, 25.0.2+1 more productRed Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
moby	moby	25.0.0 to before 25.0.2; before 24.0.9	25.0.2, 24.0.9	Patch available	CNA
—	github.com/docker/docker (Go)	before 24.0.9	24.0.9	Patch available	GHSA-xw73-rw38-6vjc
—	github.com/moby/moby (Go)	before 24.0.9	24.0.9	Patch available	GHSA-xw73-rw38-6vjc
—	github.com/moby/moby (Go)	25.0.0 to before 25.0.2	25.0.2	Patch available	GHSA-xw73-rw38-6vjc
—	github.com/docker/docker (Go)	25.0.0 to before 25.0.2	25.0.2	Patch available	GHSA-xw73-rw38-6vjc

moby Vendormoby Affected 25.0.0 to before 25.0.2; before 24.0.9 Fixed in 25.0.2, 24.0.9 Patch available CNA
github.com/docker/docker (Go) Vendor— Affected before 24.0.9 Fixed in 24.0.9 Patch available GHSA-xw73-rw38-6vjc
github.com/moby/moby (Go) Vendor— Affected before 24.0.9 Fixed in 24.0.9 Patch available GHSA-xw73-rw38-6vjc
github.com/moby/moby (Go) Vendor— Affected 25.0.0 to before 25.0.2 Fixed in 25.0.2 Patch available GHSA-xw73-rw38-6vjc
github.com/docker/docker (Go) Vendor— Affected 25.0.0 to before 25.0.2 Fixed in 25.0.2 Patch available GHSA-xw73-rw38-6vjc

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mobyproject:moby::::::::	before 24.0.9; 25.0.0 to before 25.0.2	Vulnerable	Mobyproject

cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:* Versions before 24.0.9; 25.0.0 to before 25.0.2 Vulnerable ·Mobyproject

Remediation

Fix · CNA moby (moby) Fixed in 25.0.2, 24.0.9
Fix · GHSA-xw73-rw38-6vjc github.com/docker/docker (Go) Fixed in 24.0.9 Advisory →
Fix · GHSA-xw73-rw38-6vjc github.com/moby/moby (Go) Fixed in 24.0.9 Advisory →
Fix · GHSA-xw73-rw38-6vjc github.com/moby/moby (Go) Fixed in 25.0.2 Advisory →
Fix · GHSA-xw73-rw38-6vjc github.com/docker/docker (Go) Fixed in 25.0.2 Advisory →

Red Hat 2 advisories

RHSA-2025:11749 Released 2025-07-24 · Red Hat rating Important
Updated 8.1 container image is now available: security and bug fix update
- Red Hat Ceph Storage 8.1 Tools rhceph/grafana-rhel9
RHSA-2025:9340 Released 2025-06-23 · Red Hat rating Important
Updated 7.1 container image is now available in the Red Hat Ecosystem Catalog.
- Red Hat Ceph Storage 7.1 Tools rhceph/grafana-rhel9, rhceph/rhceph-7-rhel9, rhceph/rhceph-promtail-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Ceph Storage 6	Affected	No fix yet
Red Hat Ceph Storage 7.1 Tools	Fixed	RHSA-2025:9340
Red Hat Ceph Storage 8.1 Tools	Fixed	RHSA-2025:11749

Not affected: 4 products

OpenShift Service Mesh 2
Red Hat Ceph Storage 7.1 Tools
Red Hat Ceph Storage 8.1 Tools
Red Hat OpenShift Container Platform 4

Timeline

2026-10-02 Threatist record created from CVE-2024-24557
2026-10-03 Alias added: GHSA-xw73-rw38-6vjc

References

Patch 1

https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae

Advisory 2

Other 3

TI-2026-14229 Tar extraction in moby/go-archive can write outside the destination directory via link following CVSS 4.0HIGH 7.1
TI-2021-12512 Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVSS 3.1HIGH 7.1
TI-2024-27462 Moby authz zero length regression CVSS 3.1CRITICAL 10.0
TI-2024-15672 BuildKit interactive containers API does not validate entitlements check CVSS 3.1CRITICAL 9.8
TI-2024-15671 BuildKit possible host system access from mount stub cleaner CVSS 3.1CRITICAL 10.0
TI-2026-26365 Moby: AuthZ plugin bypass with oversized request body CVSS 3.1HIGH 8.8

See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences