{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-23653", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-01-19T00:18:53.234Z", "datePublished": "2024-01-31T22:03:56.667Z", "dateUpdated": "2024-08-23T18:16:30.503Z"}, "containers": {"cna": {"title": "BuildKit interactive containers API does not validate entitlements check", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g"}, {"name": "https://github.com/moby/buildkit/pull/4602", "tags": ["x_refsource_MISC"], "url": "https://github.com/moby/buildkit/pull/4602"}, {"name": "https://github.com/moby/buildkit/releases/tag/v0.12.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"}], "affected": [{"vendor": "moby", "product": "buildkit", "versions": [{"version": "< 0.12.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-01-31T22:03:56.667Z"}, "descriptions": [{"lang": "en", "value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources. \n"}], "source": {"advisory": "GHSA-wr6v-9f75-vh2g", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:06:25.351Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g"}, {"name": "https://github.com/moby/buildkit/pull/4602", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/moby/buildkit/pull/4602"}, {"name": "https://github.com/moby/buildkit/releases/tag/v0.12.5", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"}]}, {"affected": [{"vendor": "mobyproject", "product": "buildkit", "cpes": ["cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "0.12.5", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-23T18:03:21.440665Z", "id": "CVE-2024-23653", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-23T18:16:30.503Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g", "name": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/moby/buildkit/pull/4602", "name": "https://github.com/moby/buildkit/pull/4602", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5", "name": "https://github.com/moby/buildkit/releases/tag/v0.12.5", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:06:25.351Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23653", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-23T18:03:21.440665Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*"], "vendor": "mobyproject", "product": "buildkit", "versions": [{"status": "affected", "version": "0", "lessThan": "0.12.5", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-23T18:16:24.840Z"}}], "cna": {"title": "BuildKit interactive containers API does not validate entitlements check", "source": {"advisory": "GHSA-wr6v-9f75-vh2g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "moby", "product": "buildkit", "versions": [{"status": "affected", "version": "< 0.12.5"}]}], "references": [{"url": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g", "name": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/moby/buildkit/pull/4602", "name": "https://github.com/moby/buildkit/pull/4602", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5", "name": "https://github.com/moby/buildkit/releases/tag/v0.12.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources. \n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-01-31T22:03:56.667Z"}}}, "cveMetadata": {"cveId": "CVE-2024-23653", "state": "PUBLISHED", "dateUpdated": "2024-08-23T18:16:30.503Z", "dateReserved": "2024-01-19T00:18:53.234Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-01-31T22:03:56.667Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*", "matchCriteriaId": "0AAE2F08-4E4D-4B85-8230-8D5BA7788D3D", "versionEndExcluding": "0.12.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources. \n"}, {"lang": "es", "value": "BuildKit es un conjunto de herramientas para convertir c\u00f3digo fuente para crear artefactos de manera eficiente, expresiva y repetible. Adem\u00e1s de ejecutar contenedores como pasos de compilaci\u00f3n, BuildKit tambi\u00e9n proporciona API para ejecutar contenedores interactivos basados en im\u00e1genes creadas. Era posible utilizar estas API para pedirle a BuildKit que ejecutara un contenedor con privilegios elevados. Normalmente, la ejecuci\u00f3n de dichos contenedores solo se permite si el derecho especial `security.insecure` est\u00e1 habilitado tanto por la configuraci\u00f3n de buildkitd como por el usuario que inicializa la solicitud de compilaci\u00f3n. El problema se solucion\u00f3 en v0.12.5. Evite el uso de interfaces BuildKit de fuentes no confiables."}], "id": "CVE-2024-23653", "lastModified": "2024-11-21T08:58:05.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-31T22:15:54.600", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/moby/buildkit/pull/4602"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/moby/buildkit/pull/4602"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Release Notes"], "url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "moby/buildkit: Buildkit's interactive containers API does not validate entitlements check", "id": "2262226", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262226"}, "csaw": true, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-863", "details": ["BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.", "A vulnerability was found in the Moby Builder Toolkit, specifically in the Interactive Containers API, where entitlement checks are not adequately validated, caused by a missing privilege check in a GRPC endpoint when called using a custom syntax format. This flaw allows the currently running privileged container to leverage its elevated privileges, such as full Linux capabilities, to break out of the container and achieve complete host root command execution. This issue may lead to container escape to the underlying host OS when building an image using a malicious Dockerfile or upstream image (for example, when using FROM)."], "mitigation": {"lang": "en:us", "value": "Do not use BuildKit frontends from untrusted sources."}, "name": "CVE-2024-23653", "package_state": [{"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Not affected", "package_name": "odo", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Not affected", "package_name": "openshift-serverless-1/client-kn-rhel8", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Not affected", "package_name": "openshift-serverless-clients", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:service_mesh:2", "fix_state": "Not affected", "package_name": "openshift-service-mesh/istio-cni-rhel8", "product_name": "OpenShift Service Mesh 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform", "fix_state": "Not affected", "package_name": "openshift-clients", "product_name": "Red Hat Ansible Automation Platform 1.2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "openshift-clients", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "container-tools:rhel8/buildah", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "container-tools:rhel8/podman", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "buildah", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "podman", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift-clients", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3:", "fix_state": "Not affected", "package_name": "devspaces/traefik-rhel8", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Not affected", "package_name": "quay/quay-builder-rhel8", "product_name": "Red Hat Quay 3"}], "public_date": "2024-01-31T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-23653\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-23653\nhttps://github.com/moby/buildkit/pull/4602\nhttps://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g\nhttps://pkg.go.dev/vuln/GO-2024-2497\nhttps://snyk.io/blog/cve-2024-23653-buildkit-grpc-securitymode-privilege-check/"], "statement": "This vulnerability can only be exploited when a container execution is part of the build steps of another container. Additionally, an attacker needs to trick a user or process into processing an malicious Buildkit frontend. For these reasons, this flaw was rated with an important severity.\nThe risk of this vulnerability is to systems which build containers. It could have significant consequences to an organization's ability to release new versions of their software.", "threat_severity": "Important", "upstream_fix": "buildkit 0.12.5"}