GHSA-m3r6-h7wv-7xxv

Source

https://github.com/advisories/GHSA-m3r6-h7wv-7xxv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-m3r6-h7wv-7xxv/GHSA-m3r6-h7wv-7xxv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m3r6-h7wv-7xxv

Aliases

CVE-2024-23651
GO-2024-2493

Related

Published

2024-01-31T22:43:32Z

Modified

2024-02-13T18:41:54.720540Z

Severity

8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS Calculator

Summary

BuildKit vulnerable to possible race condition with accessing subpaths from cache mounts

Details

Impact

Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container.

Patches

The issue has been fixed in v0.12.5

Workarounds

Avoid using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with --mount=type=cache,source=... options.

References

https://www.openwall.com/lists/oss-security/2019/05/28/1

Database specific

{
    "nvd_published_at": "2024-01-31T22:15:54Z",
    "cwe_ids": [
        "CWE-362"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-31T22:43:32Z"
}

References

Affected packages

Go / github.com/moby/buildkit

Package

Name: github.com/moby/buildkit; View open source insights on deps.dev
Purl: pkg:golang/github.com/moby/buildkit

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.12.5