GO-2024-2497

Privilege escalation in github.com/moby/buildkit

At a glance

Published: 2024-02-07 04:19 UTC
Updated: 2026-02-04 03:48 UTC
CVE: CVE-2024-23653
Aliases: GHSA-wr6v-9f75-vh2g

Description

BuildKit provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special security.insecure entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request.

Affected packages

Package	Versions
Go · github.com/moby/buildkit	introduced 0, fixed 0.12.5

References

https://github.com/moby/buildkit/pull/4602 FIX
https://github.com/moby/buildkit/commit/92cc595cfb12891d4b3ae476e067c74250e4b71e FIX
https://github.com/moby/buildkit/commit/5026d95aa3336e97cfe46e3764f52d08bac7a10e FIX
https://github.com/moby/buildkit/releases/tag/v0.12.5 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database