moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.

🗓️ 13 Dec 2024 08:00:00Reported by MicrosoftType

Moby v25.0.5 has a race condition in builder/builder-next/adapters/snapshot/layer.go that can cause concurrent builds to trigger EnsureLayer and leak resources.

Reporter	Title	Published	Views	Family All 85
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to Race Condition due to moby ( CVE-2024-36621 )	17 Jun 202508:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to a Race Condition via Moby in Grafana (CVE-2024-36621)	29 Jul 202520:52	–	ibm
IBM Security Bulletins	Security Bulletin: Moby Multiple Concurrency and NULL Pointer Dereference Vulnerabilities Leading to DoS and Data Corruption, affects watsonx.data	5 Dec 202505:21	–	ibm
AstraLinux	Astra Linux - уязвимость в docker.io-app	3 May 202623:59	–	astralinux
Tenable Nessus	Azure Linux 3.0 Security Update: moby-engine (CVE-2024-36621)	10 Feb 202500:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP11 : docker-engine (EulerOS-SA-2025-1134)	10 Feb 202500:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP11 : docker-engine (EulerOS-SA-2025-1153)	10 Feb 202500:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2025-1171)	10 Feb 202500:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2025-1187)	10 Feb 202500:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: moby-engine (CVE-2024-36621)	19 Dec 202400:00	–	nessus