CVE-2024-56330: Stardust ICC Privilege Escalation Flaw

CVE-2024-56330 Overview

CVE-2024-56330 is a critical improper access control vulnerability in Stardust, a platform for streaming isolated desktop containers. The vulnerability exists because inter-container communication (ICC) is not disabled by default, allowing users within one container to access another container's agent. This fundamental isolation failure compromises the security boundary between containers, potentially allowing unauthorized access to sensitive data and control of adjacent container environments.

Critical Impact

Attackers can leverage the lack of ICC restrictions to break container isolation, access other containers' agents, and potentially compromise multiple tenant environments within the same Stardust deployment.

Affected Products

• Stardust platform builds prior to December 20, 2024
• Stardust deployments with default ICC configuration
• Multi-tenant Stardust environments with shared container infrastructure

Discovery Timeline

• 2024-12-20 - CVE CVE-2024-56330 published to NVD
• 2024-12-20 - Last updated in NVD database

Technical Details for CVE-2024-56330

Vulnerability Analysis

This vulnerability stems from CWE-284 (Improper Access Control), specifically relating to the failure to enforce isolation between containers in the Stardust platform. Container isolation is a fundamental security control in multi-tenant environments, designed to prevent workloads from one user or application from interacting with or accessing workloads belonging to another.

In the case of CVE-2024-56330, the inter-container communication (ICC) feature is not disabled by default. ICC allows containers running on the same Docker network to communicate with each other directly. While this may be desirable in some architectures, it creates a significant security risk in platforms like Stardust where containers are meant to be isolated desktop environments for different users or sessions.

Root Cause

The root cause of this vulnerability is the absence of proper network segmentation and access control enforcement between containers. The Stardust platform failed to disable ICC, which is typically controlled via Docker's --icc=false daemon option or equivalent network policies. Without this restriction, any container can initiate network connections to other containers on the same bridge network, effectively bypassing the intended isolation model.

Attack Vector

The attack vector is network-based and requires no user interaction or special privileges. An attacker who has access to a Stardust container can perform network reconnaissance to discover other containers on the same network segment. Once identified, the attacker can connect to other containers' agent services, potentially gaining unauthorized access to:

• Other users' desktop sessions
• Sensitive data within adjacent containers
• Container agent functionality allowing control over the compromised container

The exploitation process involves:

1. Gaining access to a legitimate Stardust container
2. Performing network scanning to identify other containers
3. Connecting to discovered container agents
4. Leveraging agent access to compromise the target container

For technical details on this vulnerability, refer to the GitHub Security Advisory.

Detection Methods for CVE-2024-56330

Indicators of Compromise

• Unexpected network traffic between containers on internal Docker bridge networks
• Connection attempts to container agent ports from non-authorized sources
• Unusual inter-container DNS queries or service discovery activity
• Authentication failures or anomalous access patterns on container agent services

Detection Strategies

• Monitor container network traffic for unexpected inter-container connections
• Implement network flow logging on Docker bridge networks to detect lateral movement
• Deploy container-aware intrusion detection systems that can identify ICC abuse
• Audit Docker daemon configuration for ICC settings (--icc flag)

Monitoring Recommendations

• Enable detailed logging of all container network activity
• Set up alerts for any container-to-container communication in isolated environments
• Monitor container agent services for connections from unexpected source IPs
• Implement container behavior baselines to detect anomalous network patterns

How to Mitigate CVE-2024-56330

Immediate Actions Required

• Upgrade Stardust to any build released after December 20, 2024
• Manually disable ICC if immediate upgrade is not possible
• Review and audit existing container network configurations
• Implement network policies to restrict container-to-container communication

Patch Information

The vulnerability has been patched in all Stardust builds released after December 20, 2024. Organizations running affected versions should upgrade to the latest release as soon as possible. The patch properly disables inter-container communication by default, enforcing the intended isolation model between desktop containers.

For detailed patch information, consult the GitHub Security Advisory.

Workarounds

• Manually disable ICC by configuring the Docker daemon with --icc=false
• Implement Docker network policies to restrict container communication
• Deploy containers on isolated networks where multi-tenancy is required
• Use firewall rules to block inter-container traffic at the network level

# Configuration example - Disable ICC in Docker daemon
# Edit /etc/docker/daemon.json and add:
{
  "icc": false,
  "iptables": true
}

# Restart Docker daemon to apply changes
sudo systemctl restart docker