PT-2024-1519 · Buildkit+4 · Buildkit+4
Rmcnamara-Snyk
·
Published
2024-01-31
·
Updated
2026-05-18
·
CVE-2024-23651
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
BuildKit versions prior to 0.12.5
Description
The issue is related to a race condition that can occur when two malicious build steps run in parallel, sharing the same cache mounts with subpaths. This can lead to files from the host system being accessible to the build container.
Recommendations
For versions prior to 0.12.5, update to version 0.12.5 to resolve the issue.
As a temporary workaround, consider avoiding the use of BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with --mount=type=cache,source=... options.
Exploit
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Buildkit
Linuxmint
Suse
Ubuntu