CVE-2023-28842: 
Docker vulnerability analysis and mitigation

CVE-2023-28842 affects Moby, an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The vulnerability was discovered in April 2023 and affects versions from 1.12.0 up to (excluding) 20.10.24 and from 23.0.0 up to (excluding) 23.0.3. The issue exists in the overlay network driver, a core feature of Swarm Mode, which provides isolated virtual LANs for container communication across clusters (GitHub Advisory).

The vulnerability occurs in encrypted overlay networks which use VXLAN (Virtual Extensible LAN) to encapsulate link-layer Ethernet frames in UDP datagrams. The encrypted overlay networks silently accept cleartext VXLAN datagrams that are tagged with the VNI (VXLAN Network ID) of an encrypted overlay network. This implementation flaw allows potential attackers to inject arbitrary Ethernet frames into the encrypted overlay network by encapsulating them in VXLAN datagrams. The vulnerability has been assigned a CVSS v3.1 base score of 6.8 (Medium) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N (NVD).

The vulnerability allows attackers to inject arbitrary Ethernet frames into the encrypted overlay network, potentially leading to unauthorized network access and data manipulation. This could enable sophisticated attackers to establish UDP or TCP connections through the container's outbound gateway that would otherwise be blocked by a stateful firewall, or carry out other escalations beyond simple injection (GitHub Advisory).

Several mitigation options are available: 1) For multi-node clusters, deploy a global 'pause' container for each encrypted overlay network on every node. 2) For single-node clusters, avoid using overlay networks and use bridge networks instead. 3) Block UDP port 4789 from traffic that has not been validated by IPSec. 4) Update to patched versions: Moby releases 23.0.3 or 20.10.24, or Mirantis Container Runtime 20.10.16 (GitHub Advisory).