CVE-2023-28840: 
Docker vulnerability analysis and mitigation

CVE-2023-28840 affects Moby (Docker), an open source container framework, specifically impacting its encrypted overlay networks functionality. The vulnerability was discovered in April 2023 and affects versions from 1.12.0 up to (excluding) 20.10.24 and from 23.0.0 up to (excluding) 23.0.3. The issue lies in the implementation of iptables rules for encrypted overlay networks, where administrator-set rules can take precedence over Moby's security rules, potentially allowing unencrypted datagrams to bypass security checks (Moby Advisory).

The vulnerability stems from how Moby handles iptables rules for VXLAN (Virtual Extensible LAN) traffic in encrypted overlay networks. When setting up an encrypted overlay network endpoint, Moby installs iptables rules that rely on the u32 extension (provided by the xt_u32 kernel module) to filter VXLAN packet's VNI field. These rules are appended to the end of the INPUT filter chain, after any administrator-set rules, which can potentially override Moby's security controls (Moby Advisory). The vulnerability has a CVSS v3.1 base score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L) (NVD).

The vulnerability allows encrypted overlay networks to silently accept cleartext VXLAN datagrams tagged with the VNI of an encrypted overlay network. This enables attackers to inject arbitrary Ethernet frames into the encrypted overlay network through VXLAN datagram encapsulation. The impact includes potential Denial of Service attacks and the possibility for sophisticated attackers to establish unauthorized UDP or TCP connections through the container's outbound gateway, bypassing stateful firewalls (Moby Advisory).

Several mitigation options are available: 1) Update to patched versions (Moby releases 23.0.3 and 20.10.24, or Mirantis Container Runtime 20.10.16), 2) Close the VXLAN port (UDP port 4789) to incoming traffic at the Internet boundary to prevent VXLAN packet injection, 3) Ensure the xt_u32 kernel module is available on all nodes of the Swarm cluster (Moby Advisory).