~ / search / GHSA-4v98-7qmw-rqr8

GHSA-4v98-7qmw-rqr8

BuildKit vulnerable to possible host system access from mount stub cleaner

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-23652

Packages

EcosystemPackageAffectedFixed in
Go github.com/moby/buildkit < 0.12.5 0.12.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A malicious BuildKit frontend or Dockerfile using `RUN --mount` could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. ### Patches The issue has been fixed in v0.12.5 ### Workarounds Avoid using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing `RUN --mount` feature. ### References

References

External links from the advisory. They lead to third-party sites.