Detections
Analytics

Bottlerocket: docker-engine: security update to 2.2.0

high Tenable Self-Hosted Container Security Plugin ID 427940

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and
 other distributions of container tooling or runtimes. Moby's networking implementation allows for many
 networks, each with their own IP address range and gateway, to be defined. This feature is frequently
 referred to as custom networks, as each network can have a different driver, set of parameters and thus
 behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_.
 The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and
 other API clients may specify the `internal` parameter as well. When containers with networking are
 created, they are assigned unique network interfaces and IP addresses. The host serves as a router for
 non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs. Containers on an
 internal network may communicate between each other, but are precluded from communicating with any
 networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set
 up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately
 configured host services) is possible, and the host may communicate with any container IP directly. In
 addition to configuring the Linux kernel's various networking features to enable container networking,
 `dockerd` directly provides some services to container networks. Principal among these is serving as a
 resolver, enabling service discovery, and resolution of names from an upstream resolver. When a DNS
 request for a name that does not correspond to a container is received, the request is forwarded to the
 configured upstream resolver. This request is made from the container's network namespace: the level of
 access and routing of traffic is the same as if the request was made by the container itself. As a
 consequence of this design, containers solely attached to an internal network will be unable to resolve
 names using the upstream resolver, as the container itself is unable to communicate with that nameserver.
 Only the names of containers also attached to the internal network are able to be resolved. Many systems
 run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a
 consequence of the design described above is that containers are unable to resolve names from the host's
 configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap,
 and to allow containers to properly resolve names even when a local forwarding resolver is used on a
 loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework
 namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as
 expected. Because `dockerd` forwards DNS requests to the host loopback device, bypassing the container
 network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS
 requests to an external nameserver. By registering a domain for which they control the authoritative
 nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in
 DNS queries that will eventually be answered by their nameservers. Docker Desktop is not affected, as
 Docker Desktop always runs an internal resolver on a RFC 1918 address. Moby releases 26.0.0, 25.0.4, and
 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run
 containers intended to be solely attached to internal networks with a custom upstream address, which will
 force all upstream DNS queries to be resolved from the container's network namespace. (CVE-2024-29018)

Plugin Details

Severity: High

ID: 427940

Version: Revision 1.8

Type: Local

Published: 6/30/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.45

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2024-29018

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 3/20/2024

Reference Information

CVE: CVE-2024-29018