Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-23653

Good to know:

icon

Date: January 31, 2024

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.

Language: Go

Severity Score

Related Resources (8)

https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g
https://github.com/moby/buildkit/commit/92cc595cfb12891d4b3ae476e067c74250e4b71e
https://github.com/moby/buildkit/commit/5026d95aa3336e97cfe46e3764f52d08bac7a10e
https://github.com/moby/buildkit
https://github.com/moby/buildkit/pull/4602
https://github.com/moby/buildkit/releases/tag/v0.12.5
https://nvd.nist.gov/vuln/detail/CVE-2024-23653
https://www.mend.io/vulnerability-database/CVE-2024-23653

Severity Score

Weakness Type (CWE)

Incorrect Authorization

CWE-863

Top Fix

icon

Upgrade Version

Upgrade to version v0.12.5

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us