PT-2024-9112 · Moby+7 · Moby+7

Published 2024-11-29 · Updated 2026-01-29 · CVE-2024-36623

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: moby version 25.0.3

Description: The issue is related to a Race Condition in the streamformatter package, which can be exploited to trigger multiple concurrent write operations. This can result in data corruption or application crashes. The vulnerability can be used by a remote attacker to cause a denial of service.

Recommendations: For moby version 25.0.3, apply the available patch immediately to resolve the issue. As a temporary workaround, consider restricting access to the streamformatter package to minimize the risk of exploitation.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

AZL-53801

AZL-53804

AZL-53819

AZL-53824

AZL-53827

BDU:2024-10797

CVE-2024-36623

GHSA-GH5C-3H97-2F3Q

GO-2024-3305

OESA-2024-2507

OESA-2024-2526

OESA-2024-2527

OESA-2024-2555

OESA-2024-2556

OESA-2024-2557

OPENSUSE-SU-2024:14567-1

USN-7474-1

Affected Products

Astra Linux

Debian

Docker

Linuxmint

Red Os

Ubuntu

Moby

Streamformatter

References · 75

• https://github.com/moby/moby/commit/5689dabfb357b673abdb4391eef426f297d7d1bb · Patch
• https://github.com/moby/moby/commit/8e3bcf19748838b30e34d612832d1dc9d90363b8 · Patch
• https://osv.dev/vulnerability/OESA-2024-2557 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-23651 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-53804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36623 · Security Note
• https://bdu.fstec.ru/vul/2024-10797 · Security Note
• https://osv.dev/vulnerability/OESA-2024-2556 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3305 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gh5c-3h97-2f3q · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-28841 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36621 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2526 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-36623 · Security Note