p PatchFirst

CVE-2024-23652

CVE-2024-23652 · BuildKit possible host system access from mount stub cleaner

This page contains facts from public vulnerability sources. Check the original advisory before updating.

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.

CVSS 10.0 · Critical · EPSS 2.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • buildkit

    Versions
    • < 0.12.5: Affected

    No fix published

  • docker.io Ubuntu:Pro:16.04:LTS

    Versions
    • 1.6.2~dfsg1-1ubuntu4
    • 1.10.2-0ubuntu3
    • 1.10.2-0ubuntu4
    • 1.10.3-0ubuntu1
    • 1.10.3-0ubuntu4
    • 1.10.3-0ubuntu5
    • 1.10.3-0ubuntu6
    • 1.11.2-0ubuntu5~16.04
    • 1.12.1-0ubuntu13~16.04.1
    • 1.12.3-0ubuntu4~16.04.2
    • 1.12.6-0ubuntu1~16.04.1
    • 1.13.1-0ubuntu1~16.04.2
    • 17.03.2-0ubuntu2~16.04.1
    • 18.06.1-0ubuntu1~16.04.2
    • 18.06.1-0ubuntu1.2~16.04.1
    • 18.09.2-0ubuntu1~16.04.1
    • 18.09.5-0ubuntu1~16.04.2
    • 18.09.7-0ubuntu1~16.04.1
    • 18.09.7-0ubuntu1~16.04.4
    • 18.09.7-0ubuntu1~16.04.5
    • 18.09.7-0ubuntu1~16.04.6
    • 18.09.7-0ubuntu1~16.04.7
    • 18.09.7-0ubuntu1~16.04.9+esm1
    • 18.09.7-0ubuntu1~16.04.9+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • docker.io Ubuntu:Pro:18.04:LTS

    Versions
    • 1.13.1-0ubuntu6
    • 17.03.2-0ubuntu1
    • 17.03.2-0ubuntu3
    • 17.03.2-0ubuntu5
    • 17.12.1-0ubuntu1
    • 18.06.1-0ubuntu1~18.04.1
    • 18.06.1-0ubuntu1.2~18.04.1
    • 18.09.2-0ubuntu1~18.04.1
    • 18.09.5-0ubuntu1~18.04.2
    • 18.09.7-0ubuntu1~18.04.1
    • 18.09.7-0ubuntu1~18.04.3
    • 18.09.7-0ubuntu1~18.04.4
    • 19.03.6-0ubuntu1~18.04.1
    • 19.03.6-0ubuntu1~18.04.2
    • 19.03.6-0ubuntu1~18.04.3
    • 20.10.2-0ubuntu1~18.04.2
    • 20.10.2-0ubuntu1~18.04.3
    • 20.10.7-0ubuntu1~18.04.1
    • 20.10.7-0ubuntu1~18.04.2
    • 20.10.7-0ubuntu5~18.04.2
    • 20.10.7-0ubuntu5~18.04.3
    • 20.10.12-0ubuntu2~18.04.1
    • 20.10.21-0ubuntu1~18.04.2
    • 20.10.21-0ubuntu1~18.04.3
    • 20.10.21-0ubuntu1~18.04.3+esm1
    • 20.10.21-0ubuntu1~18.04.3+esm2
    Affected ranges
    • ECOSYSTEM: < 20.10.21-0ubuntu1~18.04.3+esm3

    Update to 20.10.21-0ubuntu1~18.04.3+esm3

  • docker.io Ubuntu:Pro:20.04:LTS

    Versions
    • 19.03.2-0ubuntu1
    • 19.03.6-0ubuntu1
    • 19.03.8-0ubuntu1
    • 19.03.8-0ubuntu1.20.04
    • 19.03.8-0ubuntu1.20.04.1
    • 19.03.8-0ubuntu1.20.04.2
    • 20.10.2-0ubuntu1~20.04.2
    • 20.10.2-0ubuntu1~20.04.3
    • 20.10.7-0ubuntu1~20.04.1
    • 20.10.7-0ubuntu1~20.04.2
    • 20.10.7-0ubuntu5~20.04.1
    • 20.10.7-0ubuntu5~20.04.2
    • 20.10.12-0ubuntu2~20.04.1
    • 20.10.21-0ubuntu1~20.04.1
    • 20.10.21-0ubuntu1~20.04.2
    • 20.10.21-0ubuntu1~20.04.4
    • 20.10.21-0ubuntu1~20.04.5
    • 20.10.21-0ubuntu1~20.04.6
    • 20.10.21-0ubuntu1~20.04.6+esm1
    Affected ranges
    • ECOSYSTEM: < 20.10.21-0ubuntu1~20.04.6+esm2

    Update to 20.10.21-0ubuntu1~20.04.6+esm2

  • docker.io-app Ubuntu:Pro:20.04:LTS

    Versions
    • 20.10.25-0ubuntu1~20.04.1
    • 20.10.25-0ubuntu1~20.04.2
    • 24.0.5-0ubuntu1~20.04.1
    • 24.0.7-0ubuntu2~20.04.1
    • 26.1.3-0ubuntu1~20.04.1
    Affected ranges
    • ECOSYSTEM: < 26.1.3-0ubuntu1~20.04.1+esm1

    Update to 26.1.3-0ubuntu1~20.04.1+esm1

  • docker.io-app Ubuntu:22.04:LTS

    Versions
    • 20.10.25-0ubuntu1~22.04.1
    • 20.10.25-0ubuntu1~22.04.2
    • 24.0.5-0ubuntu1~22.04.1
    • 24.0.7-0ubuntu2~22.04.1
    • 26.1.3-0ubuntu1~22.04.1
    • 27.5.1-0ubuntu3~22.04.1
    Affected ranges
    • ECOSYSTEM: < 27.5.1-0ubuntu3~22.04.2

    Update to 27.5.1-0ubuntu3~22.04.2

  • docker.io Ubuntu:Pro:22.04:LTS

    Versions
    • 20.10.7-0ubuntu5
    • 20.10.7-0ubuntu7
    • 20.10.12-0ubuntu1
    • 20.10.12-0ubuntu2
    • 20.10.12-0ubuntu3
    • 20.10.12-0ubuntu3+gke1.24.1
    • 20.10.12-0ubuntu4
    • 20.10.21-0ubuntu1~22.04.2
    • 20.10.21-0ubuntu1~22.04.3
    • 20.10.21-0ubuntu1~22.04.5
    • 20.10.21-0ubuntu1~22.04.6
    • 20.10.21-0ubuntu1~22.04.7
    • 20.10.21-0ubuntu1~22.04.7+esm1
    Affected ranges
    • ECOSYSTEM: < 20.10.21-0ubuntu1~22.04.7+esm2

    Update to 20.10.21-0ubuntu1~22.04.7+esm2

  • docker.io-app Ubuntu:24.04:LTS

    Versions
    • 24.0.5-0ubuntu1
    • 24.0.7-0ubuntu1
    • 24.0.7-0ubuntu2
    • 24.0.7-0ubuntu3
    • 24.0.7-0ubuntu4
    • 24.0.7-0ubuntu4.1
    • 26.1.3-0ubuntu1~24.04.1
    • 27.5.1-0ubuntu3~24.04.1
    Affected ranges
    • ECOSYSTEM: < 27.5.1-0ubuntu3~24.04.2

    Update to 27.5.1-0ubuntu3~24.04.2

  • docker.io Ubuntu:Pro:24.04:LTS

    Versions
    • 20.10.24+dfsg1-1ubuntu2
    • 20.10.25+dfsg1-2ubuntu1
    • 20.10.25+dfsg1-2ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: < 20.10.25+dfsg1-2ubuntu1+esm2

    Update to 20.10.25+dfsg1-2ubuntu1+esm2

Original sources

Check your server →