Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-23651

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container. The issue has been fixed in v0.12.5. Workarounds include, avoiding using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with --mount=type=cache,source=... options.

Published

2024-01-31T22:15:54.183

Last Modified

2024-11-21T08:58:05.560

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.7 (HIGH)

Weaknesses

Type: Primary
CWE-362

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mobyproject	buildkit	< 0.12.5	Yes

References

https://github.com/moby/buildkit/pull/4604 Patch, Vendor Advisory ([email protected])
https://github.com/moby/buildkit/releases/tag/v0.12.5 Patch, Release Notes ([email protected])
https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv Vendor Advisory ([email protected])
https://github.com/moby/buildkit/pull/4604 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/moby/buildkit/releases/tag/v0.12.5 Patch, Release Notes (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)