CVE-2024-36621

What it actually does

Race condition in builder/builder-next/adapters/snapshot/layer.go allows concurrent calls to EnsureLayer from multiple builds, resulting in resource leaks or exhaustion.

Why it matters to the business

Organizations relying on container builds may experience denial of service on build infrastructure, disrupting CI/CD pipelines and image creation workflows with low immediate risk due to absence from known exploitation lists and stable low exploit probability.

How an attack unfolds

An attacker triggers multiple concurrent builds that invoke EnsureLayer in parallel, exploiting the missing synchronization to repeatedly leak resources until exhaustion occurs.

How to fix it

Upgrade moby/moby to the commit 37545cc644344dcb576cba67eb7b6f51a463d31e or later release that resolves the race condition in layer.go.

How to confirm the fix worked

Confirm presence of synchronization primitives around EnsureLayer in layer.go after applying the fix; test by attempting concurrent builds and monitoring for resource leaks.

Typical attack path

1. Obtain ability to initiate builds against the affected builder
2. Schedule or trigger multiple builds to execute simultaneously
3. Invoke EnsureLayer concurrently without proper locking
4. Repeat operations to accumulate resource leaks
5. Achieve exhaustion of memory, file descriptors, or other build resources

How to detect it

Review builder logs for simultaneous EnsureLayer invocations and correlate with spikes in resource usage on build hosts; no widespread exploitation reported.

What your security team should do

• Apply the fix commit 37545cc644344dcb576cba67eb7b6f51a463d31e immediately on all build nodes
• Implement build queuing or rate limiting to reduce concurrent build risk until patched
• Monitor builder resource consumption for unusual exhaustion patterns