moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The     vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in     resource leaks/exhaustion. (CVE-2024-36621)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The     vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in     resource leaks/exhaustion.(CVE-2024-36621)

    moby v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to     trigger multiple concurrent write operations resulting in data corruption or application     crashes.(CVE-2024-36623)

Tenable has extracted the preceding description block directly from the EulerOS docker-engine security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of moby-engine installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-36621 advisory.

  - moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The     vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in     resource leaks/exhaustion. (CVE-2024-36621)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of moby-engine installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-36621 advisory.

  - moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The     vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in     resource leaks/exhaustion. (CVE-2024-36621)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
229567	Linux Distros Unpatched Vulnerability : CVE-2024-36621	Nessus	Misc.	medium
216042	EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2025-1187)	Nessus	Huawei Local Security Checks	high
216041	EulerOS 2.0 SP11 : docker-engine (EulerOS-SA-2025-1153)	Nessus	Huawei Local Security Checks	high
216021	EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2025-1171)	Nessus	Huawei Local Security Checks	high
216016	EulerOS 2.0 SP11 : docker-engine (EulerOS-SA-2025-1134)	Nessus	Huawei Local Security Checks	high
215768	Azure Linux 3.0 Security Update: moby-engine (CVE-2024-36621)	Nessus	Azure Linux Local Security Checks	medium
213204	CBL Mariner 2.0 Security Update: moby-engine (CVE-2024-36621)	Nessus	MarinerOS Local Security Checks	medium

Detections

Analytics

CVE-2024-36621

medium

Tenable Plugins

medium

high

high

high

high

medium

medium