Bug 2262272 (CVE-2024-23650)

Summary:	CVE-2024-23650 moby/buildkit: Possible race condition with accessing subpaths from cache mounts
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adudiak, bdettelb, brking, crizzo, davidn, dfreiber, dhanak, doconnor, drow, dsimansk, epacific, haoli, hkataria, jajackso, jburrell, jcammara, jhardy, jmitchel, jneedle, jobarker, jwendell, kegrant, kingland, koliveir, kshier, kverlaen, luizcosta, mabashia, matzew, mnovotny, nweather, owatkins, pbraun, pierdipi, rcernich, rguimara, rhuss, sausingh, sdawley, shvarugh, simaishi, smcdonal, stcannon, teagle, tfister, thavo, tkral, twalsh, vkumar, yguenane, zsadeh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	buildkit 0.12.5	Doc Type:	---
Doc Text:	A vulnerability was found in the Moby Builder Toolkit. A malicious BuildKit client or any frontend that can craft a request could lead to the BuildKit daemon crashing with a panic due to the lack of input validation. A frontend is usually specified as the #syntax line on a Dockerfile or with the --frontend flag when using the buildctl build command.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2262273
Bug Blocks:	2258742

Description Patrick Del Bello 2024-02-01 14:10:30 UTC

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.

https://github.com/moby/buildkit/pull/4601
https://github.com/moby/buildkit/releases/tag/v0.12.5
https://github.com/moby/buildkit/security/advisories/GHSA-9p26-698r-w4hx

Comment 1 Patrick Del Bello 2024-02-01 14:10:43 UTC

Created golang-github-moby-buildkit tracking bugs for this issue:

Affects: fedora-all [bug 2262273]

Comment 8 errata-xmlrpc 2024-05-22 09:28:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:2988 https://access.redhat.com/errata/RHSA-2024:2988