65 lines
2.3 KiB
Markdown
65 lines
2.3 KiB
Markdown
# Moby (Docker daemon) — CWE-407 Disclosure Brief
|
||
**2026-03-27 · Patch available — awaiting upstream merge**
|
||
|
||
## Finding
|
||
|
||
One O(n²) defect in the Moby Docker daemon's capability management. `TweakCapabilities()` uses `slices.Contains(capDrop)` in a loop over all capabilities, causing O(n²) processing per container start. Patch ready for upstream review.
|
||
|
||
## The Defects
|
||
|
||
**moby-0001 (PATCHED — HIGH):** `daemon/pkg/oci/caps/utils.go`
|
||
|
||
```go
|
||
// TweakCapabilities() — per container start:
|
||
for _, cap := range allCaps {
|
||
if slices.Contains(capDrop, cap) { // O(n) per cap per container start
|
||
continue
|
||
}
|
||
...
|
||
}
|
||
```
|
||
|
||
`slices.Contains(capDrop)` performs O(n) scan over `capDrop` for every capability in `allCaps`. For N capabilities and D dropped caps: **O(N × D) per container start**. **Measured ratio: 38×.**
|
||
|
||
## Complexity Proof
|
||
|
||
For N=40 capabilities, D=38 dropped caps:
|
||
- O(N×D) = 1,520 comparisons per container start
|
||
- Fixed: `map[string]bool` cap-drop set → O(N + D)
|
||
- **38× measured ratio.**
|
||
|
||
## Impact
|
||
|
||
All Docker Engine / Moby deployments launching containers with capability modification — essentially all production Docker and Kubernetes deployments using default security profiles. `TweakCapabilities()` runs on every `docker run` and every container start. CI/CD systems, container platforms, and Kubernetes nodes with high container launch rates are most affected. Moby is the upstream project for Docker Engine.
|
||
|
||
## The Fix
|
||
|
||
Pre-build a `map[string]bool` from `capDrop` before the loop:
|
||
|
||
```go
|
||
// Before
|
||
for _, cap := range allCaps {
|
||
if slices.Contains(capDrop, cap) { continue } // O(D) per cap
|
||
}
|
||
|
||
// After
|
||
// CWE-407 fix: map[string]bool for O(1) drop-check instead of O(D) slices.Contains.
|
||
dropSet := make(map[string]bool, len(capDrop))
|
||
for _, c := range capDrop { dropSet[c] = true }
|
||
for _, cap := range allCaps {
|
||
if dropSet[cap] { continue }
|
||
}
|
||
```
|
||
|
||
## Patch
|
||
|
||
`defects/moby/patch/moby-0001-caps-utils-map.patch`
|
||
|
||
## What We Ask
|
||
|
||
1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
|
||
2. Validate the patch against your capability management test suite.
|
||
3. Assess CVE eligibility — fires on every container start with capability modification.
|
||
4. Coordinate a disclosure date — we are targeting 90 days from first contact.
|
||
|
||
Contact: see cover email. This brief is confidential until coordinated disclosure.
|