ADS-TEC Industrial IT: Docker vulnerability affects multiple products
The affected products and versions present a vulnerability due to a vulnerable integrated software component the docker runc <= 1.1.11. In the worst-case scenario, the integrated Docker container environment could be compromised, potentially enabling the execution of arbitrary code within the Docker environment or neighboring Docker containers if dockerfiles or Docker images from untrusted sources are utilized. It's crucial to emphasize that while the Docker environment is vulnerable, the host operating system remains unharmed due to its isolation from the Docker environment within the ads-tec products. Using Docker images or Dockerfiles from untrusted sources poses a risk. This advice is especially pertinent for Docker use in productive operational technology (OT) environments, and it's our expectation that our customers adhere strictly to this guidance anyway.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-21626US | high8.6 | Exploit | ||
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- Mitigation
Follow the suggestions of the Docker project:If you are unable to update to an unaffected version promptly after it is released, follow these best practices to mitigate risk: Only use trusted Docker images Don't build Docker images from untrusted sources or untrusted Dockerfiles. For users who wish to ensure their device remains secure and there is an indication that the device may havebeen compromised, we recommend updating the device firmware and reinstalling all Docker images. The update process for the device will clear and reset the writable parts of the chroot filesystem environment, ensuring no remnants are left behind. This precautionary measure is advised only if there's evidence suggesting that the docker environment on the device might be compromised.
- Fixed
The issue is resolved with IRF1000 version 1.6.10 and IRF3000 version 1.3.10
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan