CVE-2024-23653
Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.98%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.98% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863
- Affected
- mobyproject/buildkit
- Source
- security-advisories@github.com
References
- https://github.com/moby/buildkit/pull/4602Patch, Vendor Advisory
- https://github.com/moby/buildkit/releases/tag/v0.12.5Patch, Release Notes
- https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2gVendor Advisory
- https://github.com/moby/buildkit/pull/4602Patch, Vendor Advisory
- https://github.com/moby/buildkit/releases/tag/v0.12.5Patch, Release Notes
- https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2gVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.