CVE-2024-23653: BuildKit interactive containers API does not validate entitlements check
Impact In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special security.insecure entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request.
Patches The issue has been fixed in v0.12.5 .
Workarounds Avoid using BuildKit frontends from untrusted sources. A frontend image is usually specified as the #syntax line on your Dockerfile, or with --frontend flag when using buildctl build command.
References
Other sources
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special security.insecure entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/moby/buildkitto a version that resolves this vulnerability.Fixed in 0.12.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.12.5 - Configuration
Avoid using BuildKit frontends from untrusted sources (specified via Dockerfile #syntax or via buildctl build --frontend).
BuildKit build frontends Use of untrusted frontends = Avoid
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23653?
CVE-2024-23653 has a high severity due to the potential for running containers with elevated privileges.
How do I fix CVE-2024-23653?
To fix CVE-2024-23653, upgrade to BuildKit version 0.12.5 or later.
What are the affected versions of BuildKit for CVE-2024-23653?
Affected versions of BuildKit range up to but not including version 0.12.5.
What is the impact of CVE-2024-23653?
CVE-2024-23653 allows unauthorized access to run interactive containers with elevated privileges.
Is CVE-2024-23653 related to any specific software?
CVE-2024-23653 specifically affects Mobyproject BuildKit.