CVE-2024-23653

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/moby/buildkit/pull/4602	Patch Vendor Advisory
https://github.com/moby/buildkit/releases/tag/v0.12.5	Patch Release Notes
https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-01-31 22:15

Updated : 2024-02-09 01:44

NVD link : CVE-2024-23653

Mitre link : CVE-2024-23653

CVE.ORG link : CVE-2024-23653

JSON object : View

Products Affected

mobyproject

buildkit

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2024-23653", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-01-31T22:15:54.600", "references": [{"url": "https://github.com/moby/buildkit/pull/4602", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5", "tags": ["Patch", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources. \n"}, {"lang": "es", "value": "BuildKit es un conjunto de herramientas para convertir c\u00f3digo fuente para crear artefactos de manera eficiente, expresiva y repetible. Adem\u00e1s de ejecutar contenedores como pasos de compilaci\u00f3n, BuildKit tambi\u00e9n proporciona API para ejecutar contenedores interactivos basados en im\u00e1genes creadas. Era posible utilizar estas API para pedirle a BuildKit que ejecutara un contenedor con privilegios elevados. Normalmente, la ejecuci\u00f3n de dichos contenedores solo se permite si el derecho especial `security.insecure` est\u00e1 habilitado tanto por la configuraci\u00f3n de buildkitd como por el usuario que inicializa la solicitud de compilaci\u00f3n. El problema se solucion\u00f3 en v0.12.5. Evite el uso de interfaces BuildKit de fuentes no confiables."}], "lastModified": "2024-02-09T01:44:46.710", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AAE2F08-4E4D-4B85-8230-8D5BA7788D3D", "versionEndExcluding": "0.12.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}