Lucene search

GoogleOSV:GO-2024-2493

HistoryFeb 13, 2024 - 6:23 p.m.

Host system file access in github.com/moby/buildkit

2024-02-1318:23:00

Google

osv.dev

github

moby buildkit

file access

race condition

build container

software

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

29.5%

JSON

Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container.

References

github.com/moby/buildkit/pull/4604

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

29.5%

JSON

Related for OSV:GO-2024-2493