Vulnerabilites related to mobyproject - buildkit
cve-2024-23650
Vulnerability from cvelistv5
Published
2024-01-31 21:42
Modified
2024-11-12 20:15
Severity ?
EPSS score ?
Summary
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/moby/buildkit/security/advisories/GHSA-9p26-698r-w4hx | x_refsource_CONFIRM | |
| https://github.com/moby/buildkit/pull/4601 | x_refsource_MISC | |
| https://github.com/moby/buildkit/releases/tag/v0.12.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.309Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/moby/buildkit/security/advisories/GHSA-9p26-698r-w4hx",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-9p26-698r-w4hx"
},
{
"name": "https://github.com/moby/buildkit/pull/4601",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moby/buildkit/pull/4601"
},
{
"name": "https://github.com/moby/buildkit/releases/tag/v0.12.5",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:moby:buildkit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "buildkit",
"vendor": "moby",
"versions": [
{
"lessThan": "0.12.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23650",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-12T20:14:10.344196Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:15:05.078Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "buildkit",
"vendor": "moby",
"versions": [
{
"status": "affected",
"version": "\u003c 0.12.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-31T21:42:13.382Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/moby/buildkit/security/advisories/GHSA-9p26-698r-w4hx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-9p26-698r-w4hx"
},
{
"name": "https://github.com/moby/buildkit/pull/4601",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moby/buildkit/pull/4601"
},
{
"name": "https://github.com/moby/buildkit/releases/tag/v0.12.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
}
],
"source": {
"advisory": "GHSA-9p26-698r-w4hx",
"discovery": "UNKNOWN"
},
"title": "BuildKit possible panic when incorrect parameters sent from frontend"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-23650",
"datePublished": "2024-01-31T21:42:13.382Z",
"dateReserved": "2024-01-19T00:18:53.234Z",
"dateUpdated": "2024-11-12T20:15:05.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-23651
Vulnerability from cvelistv5
Published
2024-01-31 21:49
Modified
2024-08-01 23:06
Severity ?
EPSS score ?
Summary
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container. The issue has been fixed in v0.12.5. Workarounds include, avoiding using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with --mount=type=cache,source=... options.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv | x_refsource_CONFIRM | |
| https://github.com/moby/buildkit/pull/4604 | x_refsource_MISC | |
| https://github.com/moby/buildkit/releases/tag/v0.12.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.341Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv"
},
{
"name": "https://github.com/moby/buildkit/pull/4604",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moby/buildkit/pull/4604"
},
{
"name": "https://github.com/moby/buildkit/releases/tag/v0.12.5",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "buildkit",
"vendor": "moby",
"versions": [
{
"status": "affected",
"version": "\u003c 0.12.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container. The issue has been fixed in v0.12.5. Workarounds include, avoiding using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with --mount=type=cache,source=... options.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-31T22:00:36.755Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv"
},
{
"name": "https://github.com/moby/buildkit/pull/4604",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moby/buildkit/pull/4604"
},
{
"name": "https://github.com/moby/buildkit/releases/tag/v0.12.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
}
],
"source": {
"advisory": "GHSA-m3r6-h7wv-7xxv",
"discovery": "UNKNOWN"
},
"title": "BuildKit possible race condition with accessing subpaths from cache mounts"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-23651",
"datePublished": "2024-01-31T21:49:18.041Z",
"dateReserved": "2024-01-19T00:18:53.234Z",
"dateUpdated": "2024-08-01T23:06:25.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-26054
Vulnerability from cvelistv5
Published
2023-03-06 18:05
Modified
2025-02-13 16:44
Severity ?
EPSS score ?
Summary
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation. Git URL can be passed in two ways: 1) Invoking build directly from a URL with credentials. 2) If the client sends additional version control system (VCS) info hint parameters on builds from a local source. Usually, that would mean reading the origin URL from `.git/config` file. When a build is performed under specific conditions where credentials were passed to BuildKit they may be visible to everyone who has access to provenance attestation. Provenance attestations and VCS info hints were added in version v0.11.0. Previous versions are not vulnerable. In v0.10, when building directly from Git URL, the same URL could be visible in `BuildInfo` structure that is a predecessor of Provenance attestations. Previous versions are not vulnerable. This bug has been fixed in v0.11.4. Users are advised to upgrade. Users unable to upgrade may disable VCS info hints by setting `BUILDX_GIT_INFO=0`. `buildctl` does not set VCS hints based on `.git` directory, and values would need to be passed manually with `--opt`.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:39:06.521Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/moby/buildkit/security/advisories/GHSA-gc89-7gcr-jxqc",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-gc89-7gcr-jxqc"
},
{
"name": "https://github.com/moby/buildkit/commit/75123c696506bdbca1ed69906479e200f1b62604",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moby/buildkit/commit/75123c696506bdbca1ed69906479e200f1b62604"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "buildkit",
"vendor": "moby",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.10.0, \u003c 0.11.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation. Git URL can be passed in two ways: 1) Invoking build directly from a URL with credentials. 2) If the client sends additional version control system (VCS) info hint parameters on builds from a local source. Usually, that would mean reading the origin URL from `.git/config` file. When a build is performed under specific conditions where credentials were passed to BuildKit they may be visible to everyone who has access to provenance attestation. Provenance attestations and VCS info hints were added in version v0.11.0. Previous versions are not vulnerable. In v0.10, when building directly from Git URL, the same URL could be visible in `BuildInfo` structure that is a predecessor of Provenance attestations. Previous versions are not vulnerable. This bug has been fixed in v0.11.4. Users are advised to upgrade. Users unable to upgrade may disable VCS info hints by setting `BUILDX_GIT_INFO=0`. `buildctl` does not set VCS hints based on `.git` directory, and values would need to be passed manually with `--opt`."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-15T20:06:26.290Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/moby/buildkit/security/advisories/GHSA-gc89-7gcr-jxqc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-gc89-7gcr-jxqc"
},
{
"name": "https://github.com/moby/buildkit/commit/75123c696506bdbca1ed69906479e200f1b62604",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moby/buildkit/commit/75123c696506bdbca1ed69906479e200f1b62604"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/"
}
],
"source": {
"advisory": "GHSA-gc89-7gcr-jxqc",
"discovery": "UNKNOWN"
},
"title": "Credentials inlined to Git URLs could end up in provenance attestation in BuildKit"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-26054",
"datePublished": "2023-03-06T18:05:07.602Z",
"dateReserved": "2023-02-17T22:44:03.151Z",
"dateUpdated": "2025-02-13T16:44:46.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-23652
Vulnerability from cvelistv5
Published
2024-01-31 21:57
Modified
2024-08-01 23:06
Severity ?
EPSS score ?
Summary
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8 | x_refsource_CONFIRM | |
| https://github.com/moby/buildkit/pull/4603 | x_refsource_MISC | |
| https://github.com/moby/buildkit/releases/tag/v0.12.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.358Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8"
},
{
"name": "https://github.com/moby/buildkit/pull/4603",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moby/buildkit/pull/4603"
},
{
"name": "https://github.com/moby/buildkit/releases/tag/v0.12.5",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "buildkit",
"vendor": "moby",
"versions": [
{
"status": "affected",
"version": "\u003c 0.12.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-31T21:57:42.774Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8"
},
{
"name": "https://github.com/moby/buildkit/pull/4603",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moby/buildkit/pull/4603"
},
{
"name": "https://github.com/moby/buildkit/releases/tag/v0.12.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
}
],
"source": {
"advisory": "GHSA-4v98-7qmw-rqr8",
"discovery": "UNKNOWN"
},
"title": "BuildKit possible host system access from mount stub cleaner"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-23652",
"datePublished": "2024-01-31T21:57:42.774Z",
"dateReserved": "2024-01-19T00:18:53.234Z",
"dateUpdated": "2024-08-01T23:06:25.358Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-23653
Vulnerability from cvelistv5
Published
2024-01-31 22:03
Modified
2024-08-23 18:16
Severity ?
EPSS score ?
Summary
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g | x_refsource_CONFIRM | |
| https://github.com/moby/buildkit/pull/4602 | x_refsource_MISC | |
| https://github.com/moby/buildkit/releases/tag/v0.12.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:06:25.351Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g"
},
{
"name": "https://github.com/moby/buildkit/pull/4602",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moby/buildkit/pull/4602"
},
{
"name": "https://github.com/moby/buildkit/releases/tag/v0.12.5",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "buildkit",
"vendor": "mobyproject",
"versions": [
{
"lessThan": "0.12.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23653",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-23T18:03:21.440665Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-23T18:16:30.503Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "buildkit",
"vendor": "moby",
"versions": [
{
"status": "affected",
"version": "\u003c 0.12.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources. \n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-31T22:03:56.667Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g"
},
{
"name": "https://github.com/moby/buildkit/pull/4602",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moby/buildkit/pull/4602"
},
{
"name": "https://github.com/moby/buildkit/releases/tag/v0.12.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
}
],
"source": {
"advisory": "GHSA-wr6v-9f75-vh2g",
"discovery": "UNKNOWN"
},
"title": "BuildKit interactive containers API does not validate entitlements check"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-23653",
"datePublished": "2024-01-31T22:03:56.667Z",
"dateReserved": "2024-01-19T00:18:53.234Z",
"dateUpdated": "2024-08-23T18:16:30.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2024-01-31 22:15
Modified
2024-11-21 08:58
Severity ?
8.7 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container. The issue has been fixed in v0.12.5. Workarounds include, avoiding using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with --mount=type=cache,source=... options.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mobyproject | buildkit | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0AAE2F08-4E4D-4B85-8230-8D5BA7788D3D",
"versionEndExcluding": "0.12.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container. The issue has been fixed in v0.12.5. Workarounds include, avoiding using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with --mount=type=cache,source=... options.\n"
},
{
"lang": "es",
"value": "BuildKit es un conjunto de herramientas para convertir c\u00f3digo fuente para crear artefactos de manera eficiente, expresiva y repetible. Dos pasos de compilaci\u00f3n maliciosos que se ejecutan en paralelo y comparten los mismos montajes de cach\u00e9 con subrutas podr\u00edan causar una condici\u00f3n de ejecuci\u00f3n que puede hacer que los archivos del sistema host sean accesibles al contenedor de compilaci\u00f3n. El problema se solucion\u00f3 en v0.12.5. Los workarounds incluyen evitar el uso de la interfaz de BuildKit desde una fuente que no es de confianza o crear un Dockerfile que no sea de confianza que contenga montajes de cach\u00e9 con las opciones --mount=type=cache,source=...."
}
],
"id": "CVE-2024-23651",
"lastModified": "2024-11-21T08:58:05.560",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 5.8,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-01-31T22:15:54.183",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/pull/4604"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch",
"Release Notes"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
},
{
"source": "security-advisories@github.com",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/pull/4604"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Release Notes"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-362"
}
],
"source": "security-advisories@github.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-01-31 22:15
Modified
2024-11-21 08:58
Severity ?
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Summary
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mobyproject | buildkit | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0AAE2F08-4E4D-4B85-8230-8D5BA7788D3D",
"versionEndExcluding": "0.12.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature."
},
{
"lang": "es",
"value": "BuildKit es un conjunto de herramientas para convertir c\u00f3digo fuente para crear artefactos de manera eficiente, expresiva y repetible. Una interfaz de BuildKit maliciosa o un Dockerfile que use RUN --mount podr\u00eda enga\u00f1ar a la funci\u00f3n que elimina archivos vac\u00edos creados para los puntos de montaje para que elimine un archivo fuera del contenedor, del sistema host. El problema se solucion\u00f3 en v0.12.5. Los workarounds incluyen evitar el uso de interfaces de BuildKit desde una fuente que no sea de confianza o crear un Dockerfile que no sea de confianza que contenga la funci\u00f3n RUN --mount."
}
],
"id": "CVE-2024-23652",
"lastModified": "2024-11-21T08:58:05.700",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.8,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-01-31T22:15:54.377",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/pull/4603"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch",
"Release Notes"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
},
{
"source": "security-advisories@github.com",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/pull/4603"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Release Notes"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "security-advisories@github.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-03-06 19:15
Modified
2024-11-21 07:50
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation. Git URL can be passed in two ways: 1) Invoking build directly from a URL with credentials. 2) If the client sends additional version control system (VCS) info hint parameters on builds from a local source. Usually, that would mean reading the origin URL from `.git/config` file. When a build is performed under specific conditions where credentials were passed to BuildKit they may be visible to everyone who has access to provenance attestation. Provenance attestations and VCS info hints were added in version v0.11.0. Previous versions are not vulnerable. In v0.10, when building directly from Git URL, the same URL could be visible in `BuildInfo` structure that is a predecessor of Provenance attestations. Previous versions are not vulnerable. This bug has been fixed in v0.11.4. Users are advised to upgrade. Users unable to upgrade may disable VCS info hints by setting `BUILDX_GIT_INFO=0`. `buildctl` does not set VCS hints based on `.git` directory, and values would need to be passed manually with `--opt`.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mobyproject | buildkit | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B20CBA03-7DD3-4756-AE19-BE0B45272C1F",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation. Git URL can be passed in two ways: 1) Invoking build directly from a URL with credentials. 2) If the client sends additional version control system (VCS) info hint parameters on builds from a local source. Usually, that would mean reading the origin URL from `.git/config` file. When a build is performed under specific conditions where credentials were passed to BuildKit they may be visible to everyone who has access to provenance attestation. Provenance attestations and VCS info hints were added in version v0.11.0. Previous versions are not vulnerable. In v0.10, when building directly from Git URL, the same URL could be visible in `BuildInfo` structure that is a predecessor of Provenance attestations. Previous versions are not vulnerable. This bug has been fixed in v0.11.4. Users are advised to upgrade. Users unable to upgrade may disable VCS info hints by setting `BUILDX_GIT_INFO=0`. `buildctl` does not set VCS hints based on `.git` directory, and values would need to be passed manually with `--opt`."
},
{
"lang": "es",
"value": "BuildKit es un conjunto de herramientas para convertir c\u00f3digo fuente para crear artefactos de manera eficiente, expresiva y repetible. En las versiones afectadas, cuando el usuario env\u00eda una solicitud de compilaci\u00f3n que contiene una URL de Git que contiene credenciales y la compilaci\u00f3n crea una atestaci\u00f3n de procedencia que describe esa compilaci\u00f3n, estas credenciales podr\u00edan ser visibles desde la atestaci\u00f3n de procedencia. La URL de Git se puede pasar de dos maneras: 1) Invocando la compilaci\u00f3n directamente desde una URL con credenciales. 2) Si el cliente env\u00eda par\u00e1metros de sugerencias de informaci\u00f3n del sistema de control de versiones (VCS) adicionales en compilaciones desde una fuente local. Por lo general, eso significar\u00eda leer la URL de origen del archivo `.git/config`. Cuando se realiza una compilaci\u00f3n en condiciones espec\u00edficas en las que se pasaron credenciales a BuildKit, es posible que sean visibles para todos los que tengan acceso a la certificaci\u00f3n de procedencia. En la versi\u00f3n v0.11.0 se agregaron certificaciones de procedencia y sugerencias de informaci\u00f3n de VCS. Las versiones anteriores no son vulnerables. En la versi\u00f3n 0.10, al compilar directamente desde la URL de Git, la misma URL podr\u00eda ser visible en la estructura `BuildInfo` que es una predecesora de las certificaciones de procedencia. Las versiones anteriores no son vulnerables. Este error se ha solucionado en v0.11.4. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden desactivar las sugerencias de informaci\u00f3n de VCS configurando `BUILDX_GIT_INFO=0`. `buildctl` no establece sugerencias de VCS basadas en el directorio `.git` y los valores deber\u00edan pasarse manualmente con `--opt`."
}
],
"id": "CVE-2023-26054",
"lastModified": "2024-11-21T07:50:40.180",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-03-06T19:15:10.390",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/moby/buildkit/commit/75123c696506bdbca1ed69906479e200f1b62604"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-gc89-7gcr-jxqc"
},
{
"source": "security-advisories@github.com",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/"
},
{
"source": "security-advisories@github.com",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/"
},
{
"source": "security-advisories@github.com",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/moby/buildkit/commit/75123c696506bdbca1ed69906479e200f1b62604"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-gc89-7gcr-jxqc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-01-31 22:15
Modified
2024-11-21 08:58
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mobyproject | buildkit | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0AAE2F08-4E4D-4B85-8230-8D5BA7788D3D",
"versionEndExcluding": "0.12.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources. \n"
},
{
"lang": "es",
"value": "BuildKit es un conjunto de herramientas para convertir c\u00f3digo fuente para crear artefactos de manera eficiente, expresiva y repetible. Adem\u00e1s de ejecutar contenedores como pasos de compilaci\u00f3n, BuildKit tambi\u00e9n proporciona API para ejecutar contenedores interactivos basados en im\u00e1genes creadas. Era posible utilizar estas API para pedirle a BuildKit que ejecutara un contenedor con privilegios elevados. Normalmente, la ejecuci\u00f3n de dichos contenedores solo se permite si el derecho especial `security.insecure` est\u00e1 habilitado tanto por la configuraci\u00f3n de buildkitd como por el usuario que inicializa la solicitud de compilaci\u00f3n. El problema se solucion\u00f3 en v0.12.5. Evite el uso de interfaces BuildKit de fuentes no confiables."
}
],
"id": "CVE-2024-23653",
"lastModified": "2024-11-21T08:58:05.827",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-01-31T22:15:54.600",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/pull/4602"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch",
"Release Notes"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
},
{
"source": "security-advisories@github.com",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/pull/4602"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Release Notes"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-863"
}
],
"source": "security-advisories@github.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-01-31 22:15
Modified
2024-11-21 08:58
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mobyproject | buildkit | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0AAE2F08-4E4D-4B85-8230-8D5BA7788D3D",
"versionEndExcluding": "0.12.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.\n"
},
{
"lang": "es",
"value": "BuildKit es un conjunto de herramientas para convertir c\u00f3digo fuente para crear artefactos de manera eficiente, expresiva y repetible. Un cliente o interfaz de BuildKit malicioso podr\u00eda crear una solicitud que podr\u00eda provocar que el daemon BuildKit se bloquee en p\u00e1nico. El problema se solucion\u00f3 en v0.12.5. Como workaround, evite utilizar interfaces BuildKit de fuentes que no sean de confianza."
}
],
"id": "CVE-2024-23650",
"lastModified": "2024-11-21T08:58:05.417",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-01-31T22:15:53.990",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/pull/4601"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch",
"Release Notes"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
},
{
"source": "security-advisories@github.com",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-9p26-698r-w4hx"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/pull/4601"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Release Notes"
],
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-9p26-698r-w4hx"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-754"
}
],
"source": "security-advisories@github.com",
"type": "Primary"
}
]
}