crítica
CVE-2024-23652
moby/buildkit: possible host system access from mount stub cleaner
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GHSA10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Red Hat7.8CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Azure Linux, CBL-Mariner. Más baja según Red Hat (alta), Amazon (alta), Bottlerocket (alta), Ubuntu (media).
Descripción
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Azure Linux 3.0 | moby-engine | 0:25.0.3-1.azl3 |
| CBL-Mariner 2.0 | moby-engine | 0:20.10.27-4.cm2 |
| go::GitHub Security Advisory Go | github.com/moby/buildkit | 0.12.5 |
| alpine 3.18 | docker | 25.0.2-r0 |
| alpine 3.19 | buildkit, docker, singularity | 0.12.5-r0 y 2 más |
| alpine 3.20 | buildkit, docker, podman y 1 más | 0.12.5-r0 y 3 más |
| alpine 3.21 | buildkit, docker, podman y 1 más | 0.12.5-r0 y 3 más |
| alpine 3.22 | buildkit, docker, podman y 1 más | 0.12.5-r0 y 3 más |
| alpine 3.23 | buildkit, docker, podman y 1 más | 0.12.5-r0 y 3 más |
| alpine 3.24 | buildkit, docker, podman y 1 más | 0.12.5-r0 y 3 más |
| alpine edge | buildkit, docker, podman y 1 más | 0.12.5-r0 y 3 más |
| amazon linux 2023 | docker, docker-debuginfo, docker-debugsource | 25.0.3-1.amzn2023.0.1 |
Mostrar las 67 entradas de 23 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Azure Linux 3.0 | moby-engine | 0:25.0.3-1.azl3 |
| CBL-Mariner 2.0 | moby-engine | 0:20.10.27-4.cm2 |
| go::GitHub Security Advisory Go | github.com/moby/buildkit | 0.12.5 |
| alpine 3.18 | docker | 25.0.2-r0 |
| alpine 3.19 | buildkit | 0.12.5-r0 |
| alpine 3.19 | docker | 25.0.2-r0 |
| alpine 3.19 | singularity | 4.1.1-r0 |
| alpine 3.20 | buildkit | 0.12.5-r0 |
| alpine 3.20 | docker | 25.0.2-r0 |
| alpine 3.20 | podman | 4.9.2-r0 |
| alpine 3.20 | singularity | 4.1.1-r0 |
| alpine 3.21 | buildkit | 0.12.5-r0 |
| alpine 3.21 | docker | 25.0.2-r0 |
| alpine 3.21 | podman | 4.9.2-r0 |
| alpine 3.21 | singularity | 4.1.1-r0 |
| alpine 3.22 | buildkit | 0.12.5-r0 |
| alpine 3.22 | docker | 25.0.2-r0 |
| alpine 3.22 | podman | 4.9.2-r0 |
| alpine 3.22 | singularity | 4.1.1-r0 |
| alpine 3.23 | buildkit | 0.12.5-r0 |
| alpine 3.23 | docker | 25.0.2-r0 |
| alpine 3.23 | podman | 4.9.2-r0 |
| alpine 3.23 | singularity | 4.1.1-r0 |
| alpine 3.24 | buildkit | 0.12.5-r0 |
| alpine 3.24 | docker | 25.0.2-r0 |
| alpine 3.24 | podman | 4.9.2-r0 |
| alpine 3.24 | singularity | 4.1.1-r0 |
| alpine edge | buildkit | 0.12.5-r0 |
| alpine edge | docker | 25.0.2-r0 |
| alpine edge | podman | 4.9.2-r0 |
| alpine edge | singularity | 4.1.1-r0 |
| amazon linux 2023 | docker | 25.0.3-1.amzn2023.0.1 |
| amazon linux 2023 | docker-debuginfo | 25.0.3-1.amzn2023.0.1 |
| amazon linux 2023 | docker-debugsource | 25.0.3-1.amzn2023.0.1 |
| bottlerocket | docker-engine | 1.19.1-c325a08b |
| chainguard | buildkitd | 0.12.5-r0 |
| chainguard | conftest | 0.49.0-r1 |
| chainguard | conftest-fips | 0.48.0-r2 |
| chainguard | docker | 25.0.2-r0 |
| chainguard | guac | 0.4.0-r1 |
| chainguard | kaniko | 1.20.1-r0 |
| chainguard | kubescape | 3.0.3-r7 |
| chainguard | scorecard | 4.13.1-r4 |
| chainguard | skaffold | 2.11.0-r0 |
| chainguard | trivy | 0.49.0-r1 |
| chainguard | zot | 2.0.1-r2 |
| rapidfort amazon linux 2023 | docker | 25.0.3-1.amzn2023.0.1 |
| rapidfort ubuntu 20.04 | docker.io | 0:26.1.5+dfsg1-9ubuntu1 |
| rapidfort ubuntu 22.04 | docker.io | 0:26.1.5+dfsg1-9ubuntu1 |
| rapidfort ubuntu 24.04 | docker.io | 0:26.1.5+dfsg1-9ubuntu1 |
| ubuntu 18.04-ESM | docker.io | 20.10.21-0ubuntu1~18.04.3+esm3 |
| ubuntu 20.04-ESM | docker.io | 20.10.21-0ubuntu1~20.04.6+esm2 |
| ubuntu 20.04-ESM | docker.io-app | 26.1.3-0ubuntu1~20.04.1+esm1 |
| ubuntu 22.04 | docker.io | sin corrección indicada |
| ubuntu 22.04 | docker.io-app | 27.5.1-0ubuntu3~22.04.2 |
| ubuntu 24.04 | docker.io | sin corrección indicada |
| ubuntu 24.04 | docker.io-app | 27.5.1-0ubuntu3~24.04.2 |
| wolfi | buildkitd | 0.12.5-r0 |
| wolfi | conftest | 0.49.0-r1 |
| wolfi | docker | 25.0.2-r0 |
| wolfi | guac | 0.4.0-r1 |
| wolfi | kaniko | 1.20.1-r0 |
| wolfi | kubescape | 3.0.3-r7 |
| wolfi | scorecard | 4.13.1-r4 |
| wolfi | skaffold | 2.11.0-r0 |
| wolfi | trivy | 0.49.0-r1 |
| wolfi | zot | 2.0.1-r2 |
Referencias
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23652
- https://access.redhat.com/security/cve/CVE-2024-23652
- https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-g7c8-6228-p62r
- https://github.com/moby/buildkit
- https://github.com/moby/buildkit/pull/4603
- https://github.com/moby/buildkit/releases/tag/v0.12.5
- https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8
- https://nvd.nist.gov/vuln/detail/CVE-2024-23652