Vulnerability Report: GO-2024-2493

CVE-2024-23651, GHSA-m3r6-h7wv-7xxv
Affects: github.com/moby/buildkit
Published: Feb 13, 2024
Modified: May 20, 2024

Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container.

Affected Packages

Path

Go Versions

Symbols
github.com/moby/buildkit/executor/oci

before v0.12.5
3 unexported affected symbols
- sub
- submounts.cleanup
- submounts.subMount
github.com/moby/buildkit/snapshot

before v0.12.5
- LocalMounter
- LocalMounterWithMounts

Aliases

CVE-2024-23651
GHSA-m3r6-h7wv-7xxv

References

https://github.com/moby/buildkit/pull/4604
https://vuln.go.dev/ID/GO-2024-2493.json

Credits

@rmcnamara-snyk

Feedback

See anything missing or incorrect? Suggest an edit to this report.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL