Incorrect Authorization
CVE-2024-23653
Summary
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive, and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special "security.insecure" entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue affects github.com/moby/buildkit versions prior to 0.12.5, and v0.13.x prior to v0.13.0-beta3. Avoid using BuildKit frontends from untrusted sources.
- LOW
- NETWORK
- HIGH
- UNCHANGED
- NONE
- NONE
- HIGH
- HIGH
CWE-863 - Incorrect Authorization
Authorization is a security mechanism performed by an application to grant or deny access to the requested resources by verifying the privileges of the user. When an application lacks effective authorization mechanisms, it enables unauthorized users to gain unintended privileges and illegitimate access to resources. Such a vulnerability may result in exposure of sensitive information, denial of service, arbitrary code execution, and complete system takeover.
References
Advisory Timeline
- Published
