CVE-2024-23652
📋 TL;DR
This vulnerability in BuildKit allows malicious Dockerfiles or BuildKit frontends using RUN --mount to delete arbitrary files on the host system. It affects anyone using BuildKit to build containers from untrusted sources. The CVSS 10.0 score indicates maximum severity with no authentication required.
💻 Affected Systems
- moby/buildkit
- Docker BuildKit
📦 What is this software?
Buildkit by Mobyproject
⚠️ Risk & Real-World Impact
Worst Case
Complete host system compromise through deletion of critical system files, leading to data loss, service disruption, or privilege escalation.
Likely Case
Malicious Dockerfile from untrusted registry or CI/CD pipeline deletes configuration files, application data, or system files on the build host.
If Mitigated
Limited impact when building only trusted Dockerfiles in isolated environments with proper access controls.
🎯 Exploit Status
Exploit requires only a malicious Dockerfile with RUN --mount; no special privileges needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.12.5
Vendor Advisory: https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8
Restart Required: Yes
Instructions:
1. Update BuildKit to v0.12.5 or later. 2. For Docker: Update Docker Engine to version containing BuildKit v0.12.5. 3. Restart Docker daemon or BuildKit service.
🔧 Temporary Workarounds
Avoid untrusted BuildKit frontends
allDo not use BuildKit frontends from untrusted sources.
Disable RUN --mount for untrusted builds
allAvoid building Dockerfiles containing RUN --mount from untrusted sources.
DOCKER_BUILDKIT=0 docker build .
🧯 If You Can't Patch
- Isolate build environments using containers or VMs with minimal host access
- Implement strict source control for Dockerfiles and only build from trusted repositories
🔍 How to Verify
Check if Vulnerable:
Check BuildKit version: docker buildx version | grep github.com/moby/buildkitCheck Version:
docker buildx versionVerify Fix Applied:
Confirm version is v0.12.5 or higher: docker buildx version📡 Detection & Monitoring
Log Indicators:
- Unexpected file deletion events in host system logs during container builds
- BuildKit errors related to mount operations
Network Indicators:
- Build requests from untrusted sources to build servers
SIEM Query:
source="docker" AND "build" AND ("RUN --mount" OR "mountpoint")🔗 References
- https://github.com/moby/buildkit/pull/4603
- https://github.com/moby/buildkit/releases/tag/v0.12.5
- https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8
- https://github.com/moby/buildkit/pull/4603
- https://github.com/moby/buildkit/releases/tag/v0.12.5
- https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8
