Log in Start free

Vulnerability · Published Jan 31, 2024 · Assigned by GitHub_M

CVE-2024-23652BuildKit possible host system access from mount stub cleaner

Critical 10.0

In plain English

A critical-severity path traversal in buildkit from moby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)2.5%top 15.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20buildkit0.12.5-r0ALPINE-CVE-2024-23652
Alpine:v3.21buildkit0.12.5-r0ALPINE-CVE-2024-23652
Alpine:v3.22buildkit0.12.5-r0ALPINE-CVE-2024-23652
Alpine:v3.23buildkit0.12.5-r0ALPINE-CVE-2024-23652
Alpine:v3.24buildkit0.12.5-r0ALPINE-CVE-2024-23652
Alpine:v3.20docker25.0.2-r0ALPINE-CVE-2024-23652
Alpine:v3.21docker25.0.2-r0ALPINE-CVE-2024-23652
Alpine:v3.22docker25.0.2-r0ALPINE-CVE-2024-23652
Alpine:v3.23docker25.0.2-r0ALPINE-CVE-2024-23652
Alpine:v3.24docker25.0.2-r0ALPINE-CVE-2024-23652
Alpine:v3.20podman4.9.2-r0ALPINE-CVE-2024-23652
Alpine:v3.21podman4.9.2-r0ALPINE-CVE-2024-23652
Alpine:v3.22podman4.9.2-r0ALPINE-CVE-2024-23652
Alpine:v3.23podman4.9.2-r0ALPINE-CVE-2024-23652
Alpine:v3.24podman4.9.2-r0ALPINE-CVE-2024-23652
Alpine:v3.20singularity4.1.1-r0ALPINE-CVE-2024-23652
Alpine:v3.21singularity4.1.1-r0ALPINE-CVE-2024-23652
Alpine:v3.22singularity4.1.1-r0ALPINE-CVE-2024-23652
Alpine:v3.23singularity4.1.1-r0ALPINE-CVE-2024-23652
Alpine:v3.24singularity4.1.1-r0ALPINE-CVE-2024-23652
Gogithub.com/moby/buildkit0.12.5GHSA-4v98-7qmw-rqr8
Gogithub.com/moby/buildkit0.12.5GO-2024-2494
Ubuntu:22.04:LTSdocker.io-app27.5.1-0ubuntu3~22.04.2UBUNTU-CVE-2024-23652
Ubuntu:24.04:LTSdocker.io-app27.5.1-0ubuntu3~24.04.2UBUNTU-CVE-2024-23652

Affected products (as reported)

VendorProductVersions
moby buildkit < 0.12.5

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

References