CVE-2024-23651
📋 TL;DR
This CVE describes a race condition vulnerability in BuildKit where two malicious build steps running in parallel with shared cache mounts could allow unauthorized access to host system files from within the build container. This affects organizations using BuildKit for container builds, particularly in CI/CD pipelines. The vulnerability requires specific cache mount configurations to be exploitable.
💻 Affected Systems
- moby/buildkit
📦 What is this software?
Buildkit by Mobyproject
⚠️ Risk & Real-World Impact
Worst Case
Attackers could exfiltrate sensitive host system files including secrets, configuration files, or source code, potentially leading to complete system compromise.
Likely Case
Unauthorized access to build environment files, potentially exposing build secrets or temporary files, but requiring specific malicious build configurations.
If Mitigated
Limited impact with proper access controls, isolated build environments, and trusted build sources only.
🎯 Exploit Status
Exploitation requires control over build steps and specific cache mount configurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.12.5
Vendor Advisory: https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv
Restart Required: Yes
Instructions:
1. Stop all BuildKit services. 2. Update BuildKit to v0.12.5 or later. 3. Restart BuildKit services. 4. Verify the update was successful.
🔧 Temporary Workarounds
Avoid untrusted build sources
allDo not use BuildKit frontends from untrusted sources or build untrusted Dockerfiles containing cache mounts.
Disable cache mounts for untrusted builds
allAvoid using --mount=type=cache,source=... options when building from untrusted sources.
🧯 If You Can't Patch
- Isolate build environments using container namespaces or virtual machines
- Implement strict access controls and audit all build configurations for cache mount usage
🔍 How to Verify
Check if Vulnerable:
Check BuildKit version: buildkitd --version. If version is below 0.12.5 and using cache mounts with parallel builds, system is vulnerable.Check Version:
buildkitd --versionVerify Fix Applied:
Verify BuildKit version is 0.12.5 or higher: buildkitd --version📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in build logs
- Multiple parallel build steps accessing same cache mounts
Network Indicators:
- Unexpected outbound connections from build containers during cache operations
SIEM Query:
source="buildkit" AND ("cache mount" OR "--mount=type=cache") AND "parallel"🔗 References
- https://github.com/moby/buildkit/pull/4604
- https://github.com/moby/buildkit/releases/tag/v0.12.5
- https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv
- https://github.com/moby/buildkit/pull/4604
- https://github.com/moby/buildkit/releases/tag/v0.12.5
- https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv
