CVE-2024-24557

CVE-2024-24557 is a cache poisoning vulnerability affecting Moby, the open-source containerization project by Docker. Specifically, the classic builder cache system can be poisoned if an image is built FROM scratch, or if certain instructions like HEALTHCHECK or ONBUILD are changed without triggering a cache miss. This allows an attacker, with knowledge of a Dockerfile, to craft a malicious image that is considered a valid cache candidate for build steps. The vulnerability has a CVSS score of 7.8 (High), indicating a local attack vector with low complexity, requiring user interaction, and potentially leading to high impact on confidentiality, integrity, and availability. Users of Moby versions older than 23.0 are fully impacted, while 23.0+ users are only affected if they explicitly opt out of Buildkit or use the /build API endpoint. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. While there is limited community discussion and media coverage, patches are available in Moby versions 24.0.9 and 25.0.2.