NULL pointer dereference in moby - CVE-2024-36620

Vulnerability identifier: #VU101382

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-36620

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in daemon/images/image_history.go. A local user can trigger crash the application.

moby
watsonx.data
Guardium Data Security Center (GDSC)
IBM Edge Application Manager
Red Hat OpenShift Container Platform
openEuler
moby
libnetwork
moby-client
moby-debuginfo
moby-engine

Install update from vendor's website.

moby - update to 26.1.0
watsonx.data - update to 2.2.2
Guardium Data Security Center (GDSC) - update to 3.8.5
Red Hat OpenShift Container Platform - update to 4.16.38
moby - update to 25.0.3-22
libnetwork - update to 25.0.3-22
moby-client - update to 25.0.3-22
moby-debuginfo - update to 25.0.3-22
moby-engine - update to 25.0.3-22

• https://gist.github.com/1047524396/f08816669701ab478a265a811d2c89b2
• https://github.com/moby/moby/blob/v26.0.2/daemon/images/image_history.go#L48
• https://github.com/moby/moby/commit/ab570ab3d62038b3d26f96a9bb585d0b6095b9b4

• Denial of service in moby
• openEuler 24.03 LTS update for moby
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Multiple vulnerabilities in IBM watsonx.data