CVE-2024-29018: 
cAdvisor vulnerability analysis and mitigation

Moby, an open source container framework that is a key component of Docker Engine and Docker Desktop, was found to have a vulnerability (CVE-2024-29018) related to DNS request forwarding. The vulnerability was discovered in March 2024 and affects Moby versions prior to 26.0.0-rc3, 25.0.5, and 23.0.11. The issue exists in Moby's networking implementation, specifically in how it handles DNS requests from internal networks (GitHub Advisory).

The vulnerability stems from Moby's networking implementation that allows creation of internal networks using the --internal flag or the internal attribute in docker-compose.yml. While containers on internal networks are supposed to be isolated from external communications, dockerd forwards DNS requests from the host network namespace when a local forwarding resolver is used on a loopback address. This bypasses the container network namespace's normal routing semantics, allowing internal networks to unexpectedly forward DNS requests to external nameservers (GitHub Advisory). The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

An attacker could potentially exploit this vulnerability to exfiltrate data from compromised containers by encoding information in DNS queries to controlled nameservers. This is possible even when containers are supposed to be isolated on internal networks. The attacker would need to register a domain with controlled authoritative nameservers to receive the encoded data (GitHub Advisory).

The vulnerability requires an attacker to have control over authoritative nameservers for a registered domain and access to a compromised container. Docker Desktop is not affected by this vulnerability as it always runs an internal resolver on a RFC 1918 address (GitHub Advisory).

The issue has been patched in Moby releases 26.0.0-rc3, 25.0.5, and 23.0.11. As a workaround, administrators can run containers intended to be solely attached to internal networks with a custom upstream address (using the --dns argument to docker run or API equivalent). This forces all upstream DNS queries to be resolved from the container network namespace (GitHub Advisory).