CVE-2024-41110
ADVISORY - githubSummary
A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low. This advisory outlines the issue, identifies the affected versions, and provides remediation steps for impacted users.
Impact
Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.
A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.
Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.
Vulnerability details
- AuthZ bypass and privilege escalation: An attacker could exploit a bypass using an API request with Content-Length set to 0, causing the Docker daemon to forward the request without the body to the AuthZ plugin, which might approve the request incorrectly.
- Initial fix: The issue was fixed in Docker Engine v18.09.1 January 2019..
- Regression: The fix was not included in Docker Engine v19.03 or newer versions. This was identified in April 2024 and patches were released for the affected versions on July 23, 2024. The issue was assigned CVE-2024-41110.
Patches
- docker-ce v27.1.1 containes patches to fix the vulnerability.
- Patches have also been merged into the master, 19.0, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches.
Remediation steps
- If you are running an affected version, update to the most recent patched version.
- Mitigation if unable to update immediately:
- Avoid using AuthZ plugins.
- Restrict access to the Docker API to trusted parties, following the principle of least privilege.
References
Common Weakness Enumeration (CWE)
Partial String Comparison
GitHub
3.1
CVSS SCORE
9.4critical| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| github.com/docker/docker | golang | - | - | >=19.03.0,<23.0.15 | 23.0.15 |
| github.com/docker/docker | golang | - | - | >=24.0.0,<25.0.6 | 25.0.6 |
| github.com/docker/docker | golang | - | - | >=26.0.0,<26.1.5 | 26.1.5 |
| github.com/docker/docker | golang | - | - | >=27.0.0,<27.1.1 | 27.1.1 |
| github.com/docker/docker | golang | - | - | >=0.0.0-20240320143339-8b79278316b5,<0.0.0-20240723193628-411e817ddf71 | 0.0.0-20240723193628-411e817ddf71 |
CVSS:4 Severity and metrics
The CVSS metrics represent different qualitative aspects of a vulnerability that impact the overall score, as defined by the CVSS Specification.
The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery (IPv6) flood leading to a denial of service on the local LAN segment (e.g., CVE-2013-6014).
Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.
The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
The attacker requires privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges.
There is a total loss of confidentiality, resulting in all information within the Vulnerable System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.
There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.
There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Vulnerable System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Vulnerable System.
There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System.
There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Vulnerable System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the Vulnerable System (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the Subsequent System (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
NIST
CVSS SCORE
9.9criticalAlpine
-
Debian
-
Ubuntu
-
CVSS SCORE
N/AhighAmazon
-
CVSS SCORE
N/AhighAmazon
-
CVSS SCORE
N/AhighAmazon
-
CVSS SCORE
N/AhighRed Hat
3.1
CVSS SCORE
9.9criticalChainguard
CGA-22pr-5vwr-fhjj
-
Chainguard
CGA-278q-94pf-jqfx
-
Chainguard
CGA-27j7-8xr9-hrcf
-
Chainguard
CGA-28vf-q5p5-4jg6
-
Chainguard
CGA-2c8w-fx65-rwf9
-
Chainguard
CGA-2gxc-mcch-rv3g
-
Chainguard
CGA-2h4w-qcrh-ffcp
-
Chainguard
CGA-2j7x-3rjg-j22q
-
Chainguard
CGA-2j9x-8f9v-frhg
-
Chainguard
CGA-2pjx-653p-w8wj
-
Chainguard
CGA-2pv6-4gjh-fqfr
-
Chainguard
CGA-2r4p-9jq9-gc3r
-
Chainguard
CGA-2rrq-c4gg-67x7
-
Chainguard
CGA-2xmv-vg3f-p4jj
-
Chainguard
CGA-33cr-qwp7-5vh8
-
Chainguard
CGA-3fcp-vq43-59qf
-
Chainguard
CGA-3fm8-q73f-f949
-
Chainguard
CGA-3qvw-9vgr-rw88
-
Chainguard
CGA-3r43-4524-mr84
-
Chainguard
CGA-3vm4-h9gp-rfp5
-
Chainguard
CGA-48xh-x5c2-76xj
-
Chainguard
CGA-4935-wffx-fpwg
-
Chainguard
CGA-4j2f-8x97-2gw8
-
Chainguard
CGA-4j5v-3qrj-cxgp
-
Chainguard
CGA-4rf5-q834-7grg
-
Chainguard
CGA-4wfp-cpjm-549m
-
Chainguard
CGA-4ww6-mc53-65xg
-
Chainguard
CGA-54v7-vhv5-c897
-
Chainguard
CGA-5cq8-jch9-7m7q
-
Chainguard
CGA-6228-fc99-fg3q
-
Chainguard
CGA-63mw-6qvj-3c2m
-
Chainguard
CGA-658v-w5jj-qjgv
-
Chainguard
CGA-65jv-pcf5-98v6
-
Chainguard
CGA-6796-987g-j9hh
-
Chainguard
CGA-689m-wqx7-xqw9
-
Chainguard
CGA-6c83-4hvv-h5c7
-
Chainguard
CGA-6ccv-pv65-fjmp
-
Chainguard
CGA-6ccw-f9r2-2c8h
-
Chainguard
CGA-6cw7-r32q-gcgj
-
Chainguard
CGA-6px5-v9jw-7wx8
-
Chainguard
CGA-6qm4-fh43-2c34
-
Chainguard
CGA-6w4h-fm63-7xv9
-
Chainguard
CGA-7737-8cjr-629f
-
Chainguard
CGA-78wx-phg8-46fx
-
Chainguard
CGA-7f8c-576x-66pp
-
Chainguard
CGA-7f9h-pf8r-j2jx
-
Chainguard
CGA-7g93-jq9w-4f2w
-
Chainguard
CGA-7hgm-72jx-7mf3
-
Chainguard
CGA-7vvx-h4j3-7gm5
-
Chainguard
CGA-7xh6-4vjw-xjqc
-
Chainguard
CGA-82j8-wm64-pc68
-
Chainguard
CGA-893c-6525-529x
-
Chainguard
CGA-8gwv-f2vm-w7xh
-
Chainguard
CGA-8j6p-jqcw-9m3m
-
Chainguard
CGA-8rh7-mrcp-5hm3
-
Chainguard
CGA-8v69-5282-44p2
-
Chainguard
CGA-8vq7-wcf3-55pc
-
Chainguard
CGA-8w3f-5r74-cwvv
-
Chainguard
CGA-8w9v-vm2p-m7q9
-
Chainguard
CGA-8whc-c7pr-ghjj
-
Chainguard
CGA-9f52-v55q-hxxh
-
Chainguard
CGA-9jvp-cq6q-hr68
-
Chainguard
CGA-9q76-q6gm-9c3g
-
Chainguard
CGA-9vh4-q6hh-jvwr
-
Chainguard
CGA-9xxq-jrwg-j4fv
-
Chainguard
CGA-c4jh-pgw7-5chh
-
Chainguard
CGA-c543-p53p-x53j
-
Chainguard
CGA-c77w-gc54-m3mc
-
Chainguard
CGA-chqx-h8hm-3gj8
-
Chainguard
CGA-cp6w-j2vg-g4fg
-
Chainguard
CGA-cpw6-xjc6-26ff
-
Chainguard
CGA-cpwc-gv8q-5chh
-
Chainguard
CGA-f4gv-g39v-62mq
-
Chainguard
CGA-f9gv-2pwm-p67r
-
Chainguard
CGA-fj8g-7fp6-qjp9
-
Chainguard
CGA-fq9r-q5f6-fj99
-
Chainguard
CGA-frx3-4pv5-r7wg
-
Chainguard
CGA-fvpj-2c4x-8w56
-
Chainguard
CGA-g7vc-gvwc-w96w
-
Chainguard
CGA-gc84-2qgx-2xxq
-
Chainguard
CGA-gh68-hq6g-vcjj
-
Chainguard
CGA-ghhc-x2xj-72p7
-
Chainguard
CGA-gvmc-pxfj-q4p3
-
Chainguard
CGA-gx2w-c68q-2m57
-
Chainguard
CGA-h3pj-cpv7-ffw4
-
Chainguard
CGA-h5p8-63jc-vw2w
-
Chainguard
CGA-h8pw-wr3p-x4vr
-
Chainguard
CGA-hfxr-gmpv-pv47
-
Chainguard
CGA-hpf2-hjfr-wmgj
-
Chainguard
CGA-hppf-3h9v-2hwv
-
Chainguard
CGA-hw29-25hr-j2xq
-
Chainguard
CGA-j54x-crcm-47r6
-
Chainguard
CGA-j894-rcfx-pjc4
-
Chainguard
CGA-jfcp-f6fh-mf5j
-
Chainguard
CGA-jg5g-8xx5-j444
-
Chainguard
CGA-jgv9-3wr2-832r
-
Chainguard
CGA-jhp9-rm93-99x3
-
Chainguard
CGA-jjjm-7q63-9rfm
-
Chainguard
CGA-jvcw-vg7q-4795
-
Chainguard
CGA-jx34-82x4-h99j
-
Chainguard
CGA-m2c6-cr9v-mgm6
-
Chainguard
CGA-m79h-m4qp-c8hr
-
Chainguard
CGA-m8xj-v67v-63g8
-
Chainguard
CGA-mch8-m3fg-wvjr
-
Chainguard
CGA-mqjg-g885-q4qv
-
Chainguard
CGA-mwfp-6448-cvxr
-
Chainguard
CGA-mx47-8v83-h76m
-
Chainguard
CGA-p35x-h5f6-5vvf
-
Chainguard
CGA-p6gp-4992-pgvq
-
Chainguard
CGA-p6vp-vpv3-42xg
-
Chainguard
CGA-p8xg-r44c-55h5
-
Chainguard
CGA-phw6-pr7g-2v87
-
Chainguard
CGA-pj27-pmg8-82wv
-
Chainguard
CGA-pmmq-q48j-rf4p
-
Chainguard
CGA-prjw-m65c-rrp4
-
Chainguard
CGA-pv9w-mr32-6qqv
-
Chainguard
CGA-pw76-rxmx-99h5
-
Chainguard
CGA-pwm2-2f7w-fc9v
-
Chainguard
CGA-pxvv-gwc6-mm84
-
Chainguard
CGA-q46c-26pc-f6m6
-
Chainguard
CGA-q664-wfhv-4v35
-
Chainguard
CGA-q6fm-62qr-2j88
-
Chainguard
CGA-q75f-3835-4m28
-
Chainguard
CGA-q867-g67v-5795
-
Chainguard
CGA-qgrq-4982-r6m2
-
Chainguard
CGA-qhc6-vpj6-4cpp
-
Chainguard
CGA-qhcm-7766-m99r
-
Chainguard
CGA-qmfq-q9mh-jrmf
-
Chainguard
CGA-qq77-273w-fmvj
-
Chainguard
CGA-qqqh-v2v4-2mcx
-
Chainguard
CGA-qx6h-hw2j-6cxv
-
Chainguard
CGA-r5h2-qf5h-2qq6
-
Chainguard
CGA-r6x2-8jhj-pfqw
-
Chainguard
CGA-rfq4-hvwh-64cj
-
Chainguard
CGA-v6q7-cwf7-6fv4
-
Chainguard
CGA-v8rc-px3r-6f43
-
Chainguard
CGA-vr6m-vhqg-vhj8
-
Chainguard
CGA-vrcc-cr2c-x7xf
-
Chainguard
CGA-vx96-f99g-4f5h
-
Chainguard
CGA-w3rv-p339-45cc
-
Chainguard
CGA-w5x5-65vj-5c8g
-
Chainguard
CGA-w6j7-38jp-8rxg
-
Chainguard
CGA-whf2-h439-h2w7
-
Chainguard
CGA-wq22-2qxm-6656
-
Chainguard
CGA-wq7x-g55g-j693
-
Chainguard
CGA-wvpj-fcw3-9m73
-
Chainguard
CGA-wx39-pppf-3vpx
-
Chainguard
CGA-x3qc-vc4x-fmp9
-
Chainguard
CGA-x493-4hg6-m6vx
-
Chainguard
CGA-x8vq-84v6-cvx2
-
Chainguard
CGA-xhm4-f8xg-gm9r
-
Chainguard
CGA-xmcc-q53c-4rp3
-
Chainguard
CGA-xp4v-8f98-xcpm
-
Chainguard
CGA-xxg7-c777-977q
-
Photon
CVE-2024-41110
-
CVSS SCORE
9.9criticalintheWild
-
-
minimos
MINI-9hrp-c429-rj9c
-
minimos
MINI-fmc7-8g6w-mq52
-
minimos
MINI-jcv9-fm5v-7pgj
-
minimos
MINI-pw36-qm67-c4vg
-
minimos
MINI-qh3v-536v-wc34
-
minimos
MINI-vr82-hf5x-mv7m
-