{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-23652", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-01-19T00:18:53.234Z", "datePublished": "2024-01-31T21:57:42.774Z", "dateUpdated": "2024-08-01T23:06:25.358Z"}, "containers": {"cna": {"title": "BuildKit possible host system access from mount stub cleaner", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8"}, {"name": "https://github.com/moby/buildkit/pull/4603", "tags": ["x_refsource_MISC"], "url": "https://github.com/moby/buildkit/pull/4603"}, {"name": "https://github.com/moby/buildkit/releases/tag/v0.12.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"}], "affected": [{"vendor": "moby", "product": "buildkit", "versions": [{"version": "< 0.12.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-01-31T21:57:42.774Z"}, "descriptions": [{"lang": "en", "value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature."}], "source": {"advisory": "GHSA-4v98-7qmw-rqr8", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:06:25.358Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8"}, {"name": "https://github.com/moby/buildkit/pull/4603", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/moby/buildkit/pull/4603"}, {"name": "https://github.com/moby/buildkit/releases/tag/v0.12.5", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*", "matchCriteriaId": "0AAE2F08-4E4D-4B85-8230-8D5BA7788D3D", "versionEndExcluding": "0.12.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature."}, {"lang": "es", "value": "BuildKit es un conjunto de herramientas para convertir c\u00f3digo fuente para crear artefactos de manera eficiente, expresiva y repetible. Una interfaz de BuildKit maliciosa o un Dockerfile que use RUN --mount podr\u00eda enga\u00f1ar a la funci\u00f3n que elimina archivos vac\u00edos creados para los puntos de montaje para que elimine un archivo fuera del contenedor, del sistema host. El problema se solucion\u00f3 en v0.12.5. Los workarounds incluyen evitar el uso de interfaces de BuildKit desde una fuente que no sea de confianza o crear un Dockerfile que no sea de confianza que contenga la funci\u00f3n RUN --mount."}], "id": "CVE-2024-23652", "lastModified": "2024-02-09T01:44:27.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-01-31T22:15:54.377", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/moby/buildkit/pull/4603"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "moby/buildkit: possible host system access from mount stub cleaner", "id": "2262225", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262225"}, "csaw": true, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.", "A vulnerability was found in the Moby Builder Toolkit, which arose from BuildKit's attempts to clean up temporarily added directories after use. A malicious BuildKit frontend or Dockerfile using RUN --mount could deceive the feature responsible for removing empty files created for the mount points, potentially leading to removing a file outside the container and affecting the host system. Successful exploitation of this issue may result in the arbitrary deletion of files and directories on the underlying host OS when building an image using a malicious Dockerfile or upstream image (for example, when using FROM)."], "mitigation": {"lang": "en:us", "value": "Do not use BuildKit frontends or Dockerfiles from untrusted sources."}, "name": "CVE-2024-23652", "package_state": [{"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Not affected", "package_name": "odo", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Not affected", "package_name": "openshift-serverless-1/client-kn-rhel8", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Not affected", "package_name": "openshift-serverless-clients", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:service_mesh:2", "fix_state": "Not affected", "package_name": "openshift-service-mesh/istio-cni-rhel8", "product_name": "OpenShift Service Mesh 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform", "fix_state": "Not affected", "package_name": "openshift-clients", "product_name": "Red Hat Ansible Automation Platform 1.2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "openshift-clients", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "impact": "low", "package_name": "buildah", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "impact": "low", "package_name": "container-tools:4.0/buildah", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "impact": "low", "package_name": "container-tools:rhel8/buildah", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "container-tools:rhel8/podman", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "impact": "low", "package_name": "buildah", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "podman", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "buildah", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift-clients", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3::el8", "fix_state": "Affected", "package_name": "devspaces/traefik-rhel8", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Affected", "package_name": "quay/quay-builder-rhel8", "product_name": "Red Hat Quay 3"}], "public_date": "2024-01-31T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-23652\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-23652\nhttps://github.com/moby/buildkit/pull/4603\nhttps://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8\nhttps://snyk.io/blog/cve-2024-23652-buildkit-build-time-container-teardown-arbitrary-delete/"], "statement": "The following are preconditions for exploiting this vulnerability:\n* A container is built using a Dockerfile\nOR\n* A BuildKit frontend is invoked with the RUN --mount command\nAdditionally, for the cleanup operations to impact the host file system the parent of the target directory needs to be replaced with a symbolic link during the build container's lifetime. For these reasons, this flaw was rated with an important severity.\nSome offerings (Notably Red Hat Enterprise Linux and Red Hat OpenShift Container Platform) include functionality that mimics certain BuildKit features via the Buildah package. However, within Buildah these temporary mount targets are consistently removed by a subprocess running in a chroot; this effectively prevents exploitation of this vulnerability. Therefore the impact for offerings which include BuildKit via Buildah are rated Low.", "threat_severity": "Important", "upstream_fix": "buildkit 0.12.5"}