CVE-2024-36623: Moby Race Condition Vulnerability

CVE-2024-36623 Overview

CVE-2024-36623 is a race condition vulnerability affecting Moby, the open-source container engine that powers Docker. The flaw resides in the streamformatter package used by Moby through version v25.0.3. Concurrent goroutines can invoke write operations on the same progressOutput instance without synchronization, producing interleaved output, data corruption, or process crashes. The issue is tracked under CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization.

Critical Impact
Attackers with low-privileged network access to a vulnerable Moby daemon can trigger concurrent writes that corrupt streamed output or crash the containerization service, disrupting workloads that depend on it.

Affected Products

Moby (mobyproject/moby) through v25.0.3
Docker Engine distributions built on affected Moby versions
Downstream container runtimes packaging vulnerable pkg/streamformatter code

Discovery Timeline

2024-11-29 - CVE-2024-36623 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36623

Vulnerability Analysis

Moby's pkg/streamformatter/streamformatter.go exposes a progressOutput type that emits JSON-formatted progress events to a shared io.Writer. The implementation lacked mutual exclusion around its WriteProgress method. When multiple goroutines write to the same underlying writer, their byte streams interleave, breaking the JSON framing contract that clients expect from the Docker Engine API.

The defect is a classic data race on a shared resource. Corrupted frames can cause client-side parsers to fail, and unsynchronized access to internal state can panic the daemon. Because API operations such as image pulls, builds, and pushes are frequently multiplexed, the race is straightforward to trigger with a modest number of concurrent requests.

Root Cause

The root cause is missing synchronization primitives around a shared writer. The progressOutput struct did not embed a sync.Mutex, so concurrent calls raced on both the writer and the intermediate JSON encoding buffer. The patch introduces a sync import and adds a mutex to serialize writes.

Attack Vector

Exploitation requires authenticated access to the Moby/Docker API over the network or local socket. An attacker issues concurrent operations that produce streamed progress output, for example parallel docker pull or docker build requests, causing the unsynchronized writer to interleave data and either return malformed responses or crash the daemon.

// Patch: pkg/streamformatter/streamformatter.go
 	"encoding/json"
 	"fmt"
 	"io"
+	"sync"
 
 	"github.com/docker/docker/pkg/jsonmessage"
 	"github.com/docker/docker/pkg/progress"

Source: moby/moby commit 5689dab and moby/moby commit 8e3bcf1. The fix imports sync and wraps progressOutput operations with a mutex so concurrent writers no longer corrupt the stream.

Detection Methods for CVE-2024-36623

Indicators of Compromise

Unexpected Docker/Moby daemon panics or restarts in dockerd logs, particularly during high-concurrency image or build operations.
Malformed JSON progress frames returned to API clients, resulting in parser errors such as invalid character or truncated jsonmessage payloads.
Bursts of concurrent API calls to endpoints that stream progress (/images/create, /build, /images/push) from a single client identity.

Detection Strategies

Inventory container hosts and identify Moby or Docker Engine builds at or below v25.0.3 using package managers and the docker version command.
Enable Docker daemon audit logging and monitor for repeated crashes correlated with concurrent streaming API calls.
Alert on abnormal parallelism from a single API client, which is uncommon in normal CI/CD workflows.

Monitoring Recommendations

Ship dockerd stdout/stderr and systemd journal entries to a centralized log platform and alert on repeated panic or goroutine traces.
Monitor container host availability metrics for daemon restart loops that can indicate exploitation attempts.
Track authenticated Docker API consumers and rate-limit clients that generate anomalous request volumes.

How to Mitigate CVE-2024-36623

Immediate Actions Required

Upgrade Moby and Docker Engine to a version that includes commits 5689dab and 8e3bcf1, which add mutex protection to progressOutput.
Restrict Docker daemon socket exposure to trusted users and networks; do not bind the API to 0.0.0.0 without TLS client authentication.
Review CI/CD pipelines that run parallel Docker operations against a shared daemon and add retries to tolerate transient failures until patching completes.

Patch Information

The fix is available in the Moby repository via commits 5689dabfb357b673abdb4391eef426f297d7d1bb and 8e3bcf19748838b30e34d612832d1dc9d90363b8. Both patches import the sync package and add a mutex to pkg/streamformatter/streamformatter.go so that progressOutput write operations are serialized. Deploy an updated Docker Engine or Moby build that incorporates these commits.

Workarounds

Limit access to the Docker Engine API using Unix socket permissions or TLS client certificates so that only trusted automation can issue concurrent requests.
Serialize container build and image transfer workflows to reduce concurrent writes to the same daemon while patching is scheduled.
Run the Docker daemon behind an authenticating reverse proxy that enforces per-client request concurrency limits.

bash

# Verify installed Docker/Moby version and confirm it includes the fix
docker version --format '{{.Server.Version}}'

# Restrict the Docker socket to the docker group only
sudo chown root:docker /var/run/docker.sock
sudo chmod 660 /var/run/docker.sock

# If exposing the API over TCP, require mutual TLS
dockerd \
  --tlsverify \
  --tlscacert=/etc/docker/ca.pem \
  --tlscert=/etc/docker/server-cert.pem \
  --tlskey=/etc/docker/server-key.pem \
  -H=0.0.0.0:2376