CVE-2024-23651: BuildKit possible race condition with accessing subpaths from cache mounts
Impact Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container.
Patches The issue has been fixed in v0.12.5
Workarounds Avoid using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with --mount=type=cache,source=... options.
References https://www.openwall.com/lists/oss-security/2019/05/28/1
Other sources
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container. The issue has been fixed in v0.12.5. Workarounds include, avoiding using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with --mount=type=cache,source=... options.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/moby/buildkitto a version that resolves this vulnerability.Fixed in 0.12.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v0.12.5 - Compensating control
Avoid using BuildKit frontend from an untrusted source, and avoid building an untrusted Dockerfile that contains cache mounts using `--mount=type=cache,source=...` options.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23651?
CVE-2024-23651 is considered a high-severity vulnerability due to the potential for unauthorized access to host system files.
How do I fix CVE-2024-23651?
To fix CVE-2024-23651, upgrade the buildkit package to version 0.12.5 or later.
What type of vulnerability is CVE-2024-23651?
CVE-2024-23651 is a race condition vulnerability that occurs when malicious build steps access shared cache mounts.
What systems are affected by CVE-2024-23651?
CVE-2024-23651 affects installations of the buildkit package prior to version 0.12.5.
Is there a workaround for CVE-2024-23651?
While the recommended solution is to upgrade, a temporary workaround involves avoiding parallel build steps that share the same cache mounts.