CVE-2024-36623

What it actually does

Race condition in streamformatter allows multiple concurrent write operations on shared streams, causing data corruption or application crashes.

Why it matters to the business

Organizations running affected moby versions risk container runtime instability, service outages, and data integrity problems; low EPSS indicates limited immediate exploitation risk but high CVSS warrants prompt attention.

How an attack unfolds

An attacker triggers concurrent operations against the streamformatter to overlap writes on shared resources, resulting in corruption or crashes; no named threat actors or KEV associations reported.

How to fix it

Upgrade moby/moby to the fixed commit 5689dabfb357b673abdb4391eef426f297d7d1bb or a later release containing the patch.

How to confirm the fix worked

Confirm the installed commit or version includes 5689dabfb357b673abdb4391eef426f297d7d1bb; perform concurrent write tests on streamformatter paths to verify absence of races.

Typical attack path

1. Identify hosts running vulnerable moby v25.0.3 or earlier
2. Trigger multiple concurrent write operations via container or API interactions
3. Cause overlapping writes leading to corruption or crash

How to detect it

Review moby process logs and container runtime events for indicators of concurrent write failures or abrupt crashes; correlate with streamformatter activity.

What your security team should do

• Apply the referenced commit or newer moby release across all affected deployments
• Monitor runtime logs for stream write errors or unexpected crashes
• Prioritize upgrades on internet-facing or high-value container hosts