CVE-2024-23650 BuildKit possible panic when incorrect parameters sent from frontend

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoi...

CVE-2024-23650

CVE-2024-23650 affects BuildKit-related tooling across multiple ecosystems. According to connected documents, affected packages include moby-engine (<24.0.9-14), moby-compose (<2.17.3-5), docker-compose (<2.27.0-1), and docker-buildx (

CVE-2024-23650

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoi...

RunC Flaws Enable Container Escapes, Granting Attackers Host Access

Multiple security vulnerabilities have been disclosed in the runC command line tool that could be exploited by threat actors to escape the bounds of the container and stage follow-on attacks. The vulnerabilities, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, have...

PT-2024-1517 · Buildkit +3 · Buildkit +3

Name of the Vulnerable Software and Affected Versions: BuildKit versions prior to 0.12.5 Description: A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the hos...

BuildKit 路径遍历漏洞

BuildKit is concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit. A path traversal vulnerability exists in BuildKit version v0.12.4 and earlier. An attacker can exploit this vulnerability to remove files external to the container from the host system...

CVE-2024-23650: Improper Check for Unusual or Exceptional Conditions

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoi...

PT-2024-20002

Name of the Vulnerable Software and Affected Versions BuildKit versions prior to 0.12.5 Description A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue is related to the conversion of source code to build artifacts. As ...

BuildKit 代码问题漏洞

BuildKit is a concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit. A code issue vulnerability exists in BuildKit. An attacker could exploit this vulnerability to cause the BuildKit daemon to crash due to panic...

CVE-2024-23653: Incorrect Authorization

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask...

BuildKit 竞争条件问题漏洞

BuildKit is concurrent, cache-efficient and Dockerfile-agnostic builder toolkit. A competitive condition issue vulnerability exists in BuildKit version v0.12.4 and prior versions, which stems from allowing access to files on the host system via build containers...

BuildKit 安全漏洞

BuildKit is concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit. A security vulnerability exists in BuildKit version v0.12.4 and earlier. An attacker could exploit this vulnerability to use the API to run containers with elevated privileges...

CVE-2024-23651: Concurrent Execution using Shared Resource with Improper Synchronization

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessibl...

CVE-2024-23652: Improper Limitation of a Pathname to a Restricted Directory

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the...

PT-2024-1519 · Buildkit +3 · Buildkit +3

Name of the Vulnerable Software and Affected Versions: BuildKit versions prior to 0.12.5 Description: The issue is related to a race condition that can occur when two malicious build steps run in parallel, sharing the same cache mounts with subpaths. This can lead to files from the host system...

PT-2024-1518 · Buildkit +1 · Buildkit +1

Name of the Vulnerable Software and Affected Versions: BuildKit versions prior to 0.12.5 Description: The issue is related to improper authorization in BuildKit, allowing a remote attacker to run containers with elevated privileges. BuildKit provides APIs for running interactive containers based ...

Improper Handling of Insufficient Privileges (Leaky Vessels)

Overview Affected versions of this package are vulnerable to Improper Handling of Insufficient Privileges Leaky Vessels via APIs for running interactive containers based on built images. It is possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, runnin...

Improper Handling of Insufficient Privileges (Leaky Vessels)

Overview Affected versions of this package are vulnerable to Improper Handling of Insufficient Privileges Leaky Vessels via APIs for running interactive containers based on built images. It is possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, runnin...

Improper Handling of Insufficient Privileges (Leaky Vessels)

Overview Affected versions of this package are vulnerable to Improper Handling of Insufficient Privileges Leaky Vessels via APIs for running interactive containers based on built images. It is possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, runnin...

Improper Handling of Insufficient Privileges (Leaky Vessels)

Overview Affected versions of this package are vulnerable to Improper Handling of Insufficient Privileges Leaky Vessels via APIs for running interactive containers based on built images. It is possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, runnin...