CVE-2023-28840
📋 TL;DR
This vulnerability in Docker/Moby's Swarm Mode allows attackers to inject arbitrary Ethernet frames into encrypted overlay networks when administrator iptables rules take precedence over Docker's security rules. This can lead to denial of service or potential packet smuggling. Affected users include anyone running Docker/Moby with Swarm Mode enabled and encrypted overlay networks.
💻 Affected Systems
- Docker
- Moby
- Mirantis Container Runtime
📦 What is this software?
Moby by Mobyproject
Moby by Mobyproject
⚠️ Risk & Real-World Impact
Worst Case
Sophisticated attacker establishes unauthorized TCP/UDP connections through container gateways, bypassing stateful firewalls to perform network-based attacks or data exfiltration.
Likely Case
Denial of service through packet injection disrupting encrypted overlay network communications between containers.
If Mitigated
Minimal impact if proper patching or workarounds are implemented before exploitation attempts.
🎯 Exploit Status
Exploitation requires network access to VXLAN traffic and knowledge of VNI values, but no authentication to Docker daemon is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Moby 23.0.3, 20.10.24; Mirantis Container Runtime 20.10.16
Vendor Advisory: https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp
Restart Required: Yes
Instructions:
1. Stop Docker daemon. 2. Update Docker/Moby to patched version using package manager. 3. Restart Docker daemon. 4. Restart Swarm services if using encrypted overlay networks.
🔧 Temporary Workarounds
Block VXLAN port at network boundary
linuxClose UDP port 4789 to incoming traffic at internet boundary to prevent VXLAN packet injection
iptables -A INPUT -p udp --dport 4789 -j DROP
Ensure xt_u32 kernel module availability
linuxLoad xt_u32 kernel module on all Swarm cluster nodes to support proper iptables filtering
modprobe xt_u32
echo 'xt_u32' >> /etc/modules-load.d/docker.conf
🧯 If You Can't Patch
- Disable encrypted overlay networks and use alternative network security mechanisms
- Implement network segmentation to isolate VXLAN traffic from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check Docker version and if using Swarm with encrypted overlay networks: docker version --format '{{.Server.Version}}' && docker network ls --filter driver=overlay --format '{{.Name}}' | xargs -I {} docker network inspect {} --format '{{.Name}}: {{.Options}}' | grep encryptedCheck Version:
docker version --format '{{.Server.Version}}'Verify Fix Applied:
Verify Docker version is patched: docker version --format '{{.Server.Version}}' | grep -E '23\.0\.3|20\.10\.24'📡 Detection & Monitoring
Log Indicators:
- Unexpected VXLAN packet drops in kernel logs
- iptables rule conflicts in system logs
Network Indicators:
- Unusual UDP traffic on port 4789 from unexpected sources
- VXLAN packets with mismatched encryption flags
SIEM Query:
source="kernel" "VXLAN" AND ("drop" OR "reject") OR source="docker" "overlay" "encrypted"🔗 References
- https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333
- https://github.com/moby/moby/issues/43382
- https://github.com/moby/moby/pull/45118
- https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp
- https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237
- https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p
- https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/
- https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333
- https://github.com/moby/moby/issues/43382
- https://github.com/moby/moby/pull/45118
- https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp
- https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237
- https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p
- https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/
