In a significant development, Docker has disclosed a critical vulnerability in certain versions of its Docker Engine, a popular platform used for developing, shipping, and running applications. This flaw, identified as CVE-2024-41110, presents a serious risk as it allows attackers to bypass authorization plugins under specific conditions. The vulnerability, carrying the maximum CVSS severity score of 10.0, highlights the urgent need for users to update their systems to mitigate potential threats.
Understanding the Flaw
The vulnerability, detailed by the Moby Project maintainers, is particularly concerning due to its nature and potential impact. An attacker can exploit this flaw by sending an API request with a Content-Length header set to zero. This action causes the Docker daemon to forward the request without its body to the AuthZ plugin, which may then incorrectly approve the request, thereby bypassing security measures intended to control access.
This issue is not entirely new. It was initially discovered in 2018 and addressed in Docker Engine version 18.09.1 released in January 2019. However, the fix was not carried over to subsequent versions, specifically from version 19.03 onward, leading to the current vulnerability.
Affected Versions and Mitigation
The flaw impacts a range of Docker Engine versions, provided the AuthZ plugin is used for access control decisions. The affected versions include:
- Versions up to 19.03.15
- Versions up to 20.10.27
- Versions up to 23.0.14
- Versions up to 24.0.9
- Versions up to 25.0.5
- Versions up to 26.0.2
- Versions up to 26.1.4
- Versions up to 27.0.3, and
- Versions up to 27.1.0
However, users of Docker Engine version 19.03.x and later who do not utilize authorization plugins, as well as users of all versions of Mirantis Container Runtime, are not vulnerable. Docker Desktop up to version 4.32.0 is also affected, though the company notes that the likelihood of exploitation is low since it requires access to the Docker API, implying that the attacker must already have local access to the host. A fix for Docker Desktop is expected in version 4.33.
Gabriela Georgieva from Docker emphasized that users who do not rely on AuthZ plugins for access control are unaffected. Additionally, privilege escalation in Docker Desktop is confined to the Docker Desktop virtual machine and does not impact the underlying host system.
Urgency for Updates
While there have been no reports of CVE-2024-41110 being exploited in the wild, the severity of this vulnerability necessitates immediate action. Users are strongly encouraged to update their Docker installations to the latest versions—23.0.14 and 27.1.0—released on July 23, 2024, to safeguard their systems against potential attacks.
Historical Context and Ongoing Concerns
This critical flaw is reminiscent of other security issues Docker has faced. Earlier this year, the company addressed a series of vulnerabilities known as Leaky Vessels. These flaws allowed attackers to gain unauthorized access to the host filesystem and escape from the container, underscoring the ongoing challenges in container security.
A recent report by Palo Alto Networks’ Unit 42 highlighted the increasing adoption of cloud services and the integral role of containers in cloud infrastructure. However, the report also pointed out the vulnerabilities inherent in container technology. Containers share the same kernel and often lack complete isolation from the host’s user-mode, making them susceptible to attacks like container escapes.
Conclusion
The discovery of CVE-2024-41110 serves as a critical reminder of the importance of maintaining up-to-date security practices and vigilant monitoring of software vulnerabilities. As Docker continues to be a cornerstone technology in cloud infrastructure, ensuring its security is paramount to protecting not only individual systems but also the broader ecosystem of applications and services that rely on it. Users should promptly apply the latest updates and review their use of authorization plugins to mitigate the risks associated with this and other potential vulnerabilities.
Follow us on 
(Twitter) for real time updates and exclusive content.
Interesting Article : Telegram App Vulnerability Exploited to Spread Malware via Videos
Pingback: CrowdStrike: New Phishing Scam Exploiting Falcon Sensor Update Issue
Your work has captivated me just as much as it has captivated you. The visual display is elegant, and the written content is impressive. Nevertheless, you seem concerned about the possibility of delivering something that may be viewed as dubious. I agree that you’ll be able to address this issue promptly.
Thanks. Keep Visiting https://www.cyasha.com for more updates.