CVE-2024-23652: BuildKit possible host system access from mount stub cleaner
Impact A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system.
Patches The issue has been fixed in v0.12.5
Workarounds Avoid using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.
References
Other sources
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/moby/buildkitto a version that resolves this vulnerability.Fixed in 0.12.5 - Upgrade
Upgrade
BuildKitto a version that resolves this vulnerability.Fixed in v0.12.5 - Compensating control
Avoid using BuildKit frontend from an untrusted source.
- Compensating control
Avoid building an untrusted Dockerfile containing the RUN --mount feature.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23652?
CVE-2024-23652 has a high severity due to its potential to remove files from the host system.
How do I fix CVE-2024-23652?
To fix CVE-2024-23652, upgrade to BuildKit version 0.12.5 or higher.
What is the impact of CVE-2024-23652?
The impact of CVE-2024-23652 allows a malicious BuildKit frontend to remove files from the host system.
Which versions are affected by CVE-2024-23652?
CVE-2024-23652 affects all versions of BuildKit prior to 0.12.5.
Is there a workaround for CVE-2024-23652?
There are no official workarounds provided for CVE-2024-23652, and upgrading is recommended.