CVE-2024-32473: 
Docker vulnerability analysis and mitigation

Moby, an open source container framework that is a key component of Docker Engine and Docker Desktop, was found to have a vulnerability in versions 26.0.0 and 26.0.1 where IPv6 was not properly disabled on network interfaces, including those belonging to networks where --ipv6=false was specified. The vulnerability was discovered and disclosed on April 18, 2024, and was assigned CVE-2024-32473 (GitHub Advisory).

The vulnerability affects containers using ipvlan or macvlan interfaces that share an external network link with the host machine. When IPv6 is not properly disabled, these interfaces remain IPv6-capable despite network configurations specifying --ipv6=false. The vulnerability has been assigned a CVSS v3.1 base score of 4.7 (MEDIUM) with vector string CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (NVD).

The vulnerability creates multiple security risks: 1) Containers can communicate with other hosts on the local network over link-local IPv6 addresses, 2) Containers may receive SLAAC-assigned addresses if router advertisements are being broadcast over the local network, and 3) The interface becomes a member of IPv6 multicast groups. This presents an unexpectedly increased attack surface for IPv4-only networks. Additionally, containers with unexpected IPv6 addresses can listen for connections, open connections to other nodes, or potentially conduct DoS attacks (GitHub Advisory).

The vulnerability requires local access and high complexity to exploit. A remote attacker could potentially send malicious Router Advertisements to divert traffic to themselves, create a black-hole, or redirect to another device. The presence of an IPv6 route could also impact container availability by affecting software behavior in dual-stack environments (GitHub Advisory).

The issue has been patched in version 26.0.2. As a workaround, IPv6 can be completely disabled in a container by using --sysctl=net.ipv6.conf.all.disable_ipv6=1 in the docker create or docker run command. Alternatively, in a compose file service configuration, users can add the sysctl configuration: sysctls: - net.ipv6.conf.all.disable_ipv6=1 (GitHub Advisory).