Vulnerability · Published Jan 31, 2024 · Assigned by GitHub_M
CVE-2024-23651BuildKit possible race condition with accessing subpaths from cache mounts
High 8.7
In plain English
A high-severity race condition in buildkit from moby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container. The issue has been fixed in v0.12.5. Workarounds include, avoiding using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with --mount=type=cache,source=... options.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | buildkit | 0.12.5-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.21 | buildkit | 0.12.5-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.22 | buildkit | 0.12.5-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.23 | buildkit | 0.12.5-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.24 | buildkit | 0.12.5-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.20 | docker | 25.0.2-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.21 | docker | 25.0.2-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.22 | docker | 25.0.2-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.23 | docker | 25.0.2-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.24 | docker | 25.0.2-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.20 | podman | 4.9.2-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.21 | podman | 4.9.2-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.22 | podman | 4.9.2-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.23 | podman | 4.9.2-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.24 | podman | 4.9.2-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.20 | singularity | 4.1.1-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.21 | singularity | 4.1.1-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.22 | singularity | 4.1.1-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.23 | singularity | 4.1.1-r0 | ALPINE-CVE-2024-23651 |
| Alpine:v3.24 | singularity | 4.1.1-r0 | ALPINE-CVE-2024-23651 |
| Go | github.com/moby/buildkit | 0.12.5 | GHSA-m3r6-h7wv-7xxv |
| Go | github.com/moby/buildkit | 0.12.5 | GO-2024-2493 |
| Ubuntu:22.04:LTS | docker.io-app | 27.5.1-0ubuntu3~22.04.2 | UBUNTU-CVE-2024-23651 |
| Ubuntu:24.04:LTS | docker.io-app | 27.5.1-0ubuntu3~24.04.2 | UBUNTU-CVE-2024-23651 |
Affected products (as reported)
Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
References
- https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv x_refsource_CONFIRM
- https://github.com/moby/buildkit/pull/4604 x_refsource_MISC
- https://github.com/moby/buildkit/releases/tag/v0.12.5 x_refsource_MISC