CVE-2024-32473

一、漏洞信息
 漏洞编号：[CVE-2024-32473](https://nvd.nist.gov/vuln/detail/CVE-2024-32473)
 漏洞归属组件：[docker](https://gitee.com/src-openeuler/docker)
 漏洞归属的版本：18.09.0
 CVSS V3.0分值：
  BaseScore：4.7 Medium
  Vector：CVSS：3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
 漏洞简述：
  Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. In 26.0.0, IPv6 is not disabled on network interfaces, including those belonging to networks where `--ipv6=false`. An container with an `ipvlan` or `macvlan` interface will normally be configured to share an external network link with the host machine. Because of this direct access, (1) Containers may be able to communicate with other hosts on the local network over link-local IPv6 addresses, (2) if router advertisements are being broadcast over the local network, containers may get SLAAC-assigned addresses, and (3) the interface  will be a member of IPv6 multicast groups. This means interfaces in IPv4-only networks present an unexpectedly and unnecessarily increased attack surface. The issue is patched in 26.0.2. To completely disable IPv6 in a container, use `--sysctl=net.ipv6.conf.all.disable_ipv6=1` in the `docker create` or `docker run` command. Or, in the service configuration of a `compose` file.
 漏洞公开时间：2024-04-19 06:15:10
 漏洞创建时间：2024-04-19 06:47:57
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-32473
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security-advisories.github.com | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 |  |
| security-advisories.github.com | https://github.com/moby/moby/security/advisories/GHSA-x84c-p2g9-rqv9 |  |
| redhat_bugzilla | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 | https://bugzilla.redhat.com/show_bug.cgi?id=2276026 |
| redhat_bugzilla | https://github.com/moby/moby/security/advisories/GHSA-x84c-p2g9-rqv9 | https://bugzilla.redhat.com/show_bug.cgi?id=2276026 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-32473 | https://ubuntu.com/security/CVE-2024-32473 |
| ubuntu | https://github.com/moby/moby/security/advisories/GHSA-x84c-p2g9-rqv9 | https://ubuntu.com/security/CVE-2024-32473 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-32473 | https://ubuntu.com/security/CVE-2024-32473 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-32473 | https://ubuntu.com/security/CVE-2024-32473 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-32473 | https://ubuntu.com/security/CVE-2024-32473 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-32473 |
| cve_search |  | https://github.com/moby/moby/security/advisories/GHSA-x84c-p2g9-rqv9 |
| cve_search |  | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 |
| github_advisory | https://github.com/moby/moby/security/advisories/GHSA-x84c-p2g9-rqv9 | https://github.com/advisories/GHSA-x84c-p2g9-rqv9 |
| github_advisory | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 | https://github.com/advisories/GHSA-x84c-p2g9-rqv9 |
| snyk | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 | https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMOBYMOBYLIBNETWORKOSL-6663331 |
| snyk | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 | https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDOCKERDOCKERLIBNETWORKOSL-6663330 |
| snyk | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 | https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMOBYMOBYINTEGRATIONNETWORKING-6663329 |
| snyk | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 | https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDOCKERDOCKERINTEGRATIONNETWORKING-6663328 |
| snyk | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 | https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMOBYMOBYINTEGRATIONNETWORKMACVLAN-6663327 |
| snyk | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 | https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDOCKERDOCKERINTEGRATIONNETWORKMACVLAN-6663326 |
| snyk | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 | https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMOBYMOBYINTEGRATIONNETWORKIPVLAN-6663325 |
| snyk | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 | https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDOCKERDOCKERINTEGRATIONNETWORKIPVLAN-6663324 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 |  | security-advisories.github.com |
|  |  | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 |  | redhat_bugzilla |
|  |  | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 |  | github_advisory |
|  |  | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 |  | snyk |
| docker.io |  | https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642 |  | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
        在26.0.0中，IPv6不会在网络接口上禁用，包括那些属于其中--ipv6=false的网络接口。具有ipvlan或macvlan接口的容器通常配置为与宿主机共享外部网络链路。由于这种直接访问，（1）容器可能能够通过本地链路IPv6地址与本地网络上的其他主机通信，（2）如果路由器通告在本地网络上广播，容器可能会获得SLAAC分配的地址，以及（3）接口将成为IPv6组播组的成员。这意味着仅IPv4网络中的接口会意外地、不必要地增加攻击面。此问题已在26.0.2中修复。要在容器中完全禁用IPv6，请在docker create或docker run命令中使用--sysctl=net.ipv6.conf.all.disable_ipv6=1。或者，在编写文件的服务配置中。   
 openEuler评分：
  4.7
 Vector：CVSS：3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
 受影响版本排查(受影响/不受影响)：
  1.master(18.09.0):受影响
2.openEuler-20.03-LTS-SP1(18.09.0):受影响
3.openEuler-20.03-LTS-SP4(18.09.0):受影响
4.openEuler-22.03-LTS(18.09.0):受影响
5.openEuler-22.03-LTS-Next(18.09.0):受影响
6.openEuler-22.03-LTS-SP1(18.09.0):受影响
7.openEuler-22.03-LTS-SP2(18.09.0):受影响
8.openEuler-22.03-LTS-SP3(18.09.0):受影响
9.openEuler-24.03-LTS:受影响
10.openEuler-24.03-LTS-Next:受影响

修复是否涉及abi变化(是/否)：
  1.master(18.09.0):否
2.openEuler-20.03-LTS-SP1(18.09.0):否
3.openEuler-20.03-LTS-SP4(18.09.0):否
4.openEuler-22.03-LTS(18.09.0):否
5.openEuler-22.03-LTS-Next(18.09.0):否
6.openEuler-22.03-LTS-SP1(18.09.0):否
7.openEuler-22.03-LTS-SP2(18.09.0):否
8.openEuler-22.03-LTS-SP3(18.09.0):否
9.openEuler-24.03-LTS:否
10.openEuler-24.03-LTS-Next:否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-1625

src-openEuler/docker

内容风险标识

评论 (17)

src-openEuler/docker .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-32473

评论 (17)

搜索帮助

src-openEuler/docker