GO-2024-2493

Host system file access in github.com/moby/buildkit

At a glance

Published: 2024-02-13 18:23 UTC
Updated: 2026-02-04 03:54 UTC
CVE: CVE-2024-23651
Aliases: GHSA-m3r6-h7wv-7xxv

Description

Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container.

Affected packages

Package	Versions
Go · github.com/moby/buildkit	introduced 0, fixed 0.12.5

References

https://github.com/moby/buildkit/pull/4604 FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database