CVE-2024-23650: BuildKit possible panic when incorrect parameters sent from frontend
Impact A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.
Patches The issue has been fixed in v0.12.5
Workarounds Avoid using BuildKit frontends from untrusted sources. A frontend image is usually specified as the #syntax line on your Dockerfile, or with --frontend flag when using buildctl build command.
References
Other sources
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/moby/buildkitto a version that resolves this vulnerability.Fixed in 0.12.5 - Upgrade
Upgrade
redhat/buildkitto a version that resolves this vulnerability.Fixed in 0.12.5 - Upgrade
Upgrade
moby/buildkitto a version that resolves this vulnerability.Fixed in v0.12.5 - Compensating control
Avoid using BuildKit frontends from untrusted sources (frontend is specified via the `#syntax` line in Dockerfile or with the `--frontend` flag when using `buildctl build`).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23650?
CVE-2024-23650 has been classified as a critical severity vulnerability due to its potential to crash the BuildKit daemon.
How do I fix CVE-2024-23650?
CVE-2024-23650 can be fixed by updating to BuildKit version 0.12.5 or later.
What causes the vulnerability CVE-2024-23650?
CVE-2024-23650 is caused by a BuildKit client or frontend sending crafted requests that lead to daemon crashes.
Can using untrusted BuildKit frontends impact CVE-2024-23650?
Yes, using untrusted BuildKit frontends can trigger CVE-2024-23650 by sending malicious requests.
Is there a workaround for CVE-2024-23650?
To mitigate CVE-2024-23650, it is recommended to avoid using BuildKit frontends from untrusted sources.