CVE-2024-23652criticalCWE-22

CVE-2024-23652: critical vulnerability in moby buildkit

BuildKit possible host system access from mount stub cleaner

Published · Updated

Follow this CVE+ Monitor BuildKit+ Monitor docker

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 10epss 2.5%
from disclosure to weapon30 days
Published on NVDJan 31
1st PoC+30d
In short

BuildKit, a container build tool, has a critical vulnerability where a malicious build configuration can trick the cleanup process into deleting files on the host system instead of just inside the container. This allows attackers to destroy important host files if they can control the Dockerfile or build frontend.

Technical detail

CWE-22 path traversal vulnerability in BuildKit's mount stub cleaner: a malicious Dockerfile or frontend using RUN --mount can exploit the post-build cleanup mechanism to delete arbitrary files on the host filesystem. Exploitation requires the attacker to supply or control the Dockerfile or BuildKit frontend; impact is unrestricted host file deletion with the privileges of the BuildKit process.

Summary generated and translated by AI from the official description.
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Affected products
moby · buildkit
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — moby buildkit

In the same product, most dangerous first.

CVE-2024-23653CRITICALBuildKit interactive containers API does not validate entitlements checkEPSS 3.4%CVE-2024-23650MEDIUMBuildKit possible panic when incorrect parameters sent from frontendEPSS 1.1%CVE-2023-26054MEDIUMCredentials inlined to Git URLs could end up in provenance attestation in BuildKitEPSS 1.0%CVE-2024-23651HIGHBuildKit possible race condition with accessing subpaths from cache mountsEPSS 0.9%CVE-2026-75593HIGHBuildKit: Malicious client can bypass destination directory validation on local sources uploadEPSS 0.5%CVE-2026-33747HIGHBuildKit vulnerable to malicious frontend causing file escape outside of storage rootEPSS 0.5%