Moby (Docker daemon) — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in the Moby Docker daemon's capability management. TweakCapabilities() uses slices.Contains(capDrop) in a loop over all capabilities, causing O(n²) processing per container start. Patch ready for upstream review.

The Defects

moby-0001 (PATCHED — HIGH): daemon/pkg/oci/caps/utils.go

// TweakCapabilities() — per container start:
for _, cap := range allCaps {
    if slices.Contains(capDrop, cap) {  // O(n) per cap per container start
        continue
    }
    ...
}

slices.Contains(capDrop) performs O(n) scan over capDrop for every capability in allCaps. For N capabilities and D dropped caps: O(N × D) per container start. Measured ratio: 38×.

Complexity Proof

For N=40 capabilities, D=38 dropped caps:

O(N×D) = 1,520 comparisons per container start
Fixed: map[string]bool cap-drop set → O(N + D)
38× measured ratio.

Impact

All Docker Engine / Moby deployments launching containers with capability modification — essentially all production Docker and Kubernetes deployments using default security profiles. TweakCapabilities() runs on every docker run and every container start. CI/CD systems, container platforms, and Kubernetes nodes with high container launch rates are most affected. Moby is the upstream project for Docker Engine.

The Fix

Pre-build a map[string]bool from capDrop before the loop:

// Before
for _, cap := range allCaps {
    if slices.Contains(capDrop, cap) { continue }  // O(D) per cap
}

// After
// CWE-407 fix: map[string]bool for O(1) drop-check instead of O(D) slices.Contains.
dropSet := make(map[string]bool, len(capDrop))
for _, c := range capDrop { dropSet[c] = true }
for _, cap := range allCaps {
    if dropSet[cap] { continue }
}

Patch

defects/moby/patch/moby-0001-caps-utils-map.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your capability management test suite.
Assess CVE eligibility — fires on every container start with capability modification.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.3 KiB Raw Blame History Unescape Escape