CWE data temporarily unavailableCWE data is currently experiencing intermittent outages, which may cause incomplete section loading on CVE pages. We are actively working on a fix.

CVE-2024-23652

Description

A vulnerability was found in the Moby Builder Toolkit, which arose from BuildKit's attempts to clean up temporarily added directories after use. A malicious BuildKit frontend or Dockerfile using RUN --mount could deceive the feature responsible for removing empty files created for the mount points, potentially leading to removing a file outside the container and affecting the host system. Successful exploitation of this issue may result in the arbitrary deletion of files and directories on the underlying host OS when building an image using a malicious Dockerfile or upstream image (for example, when using FROM).

Statement

The following are preconditions for exploiting this vulnerability:

  • A container is built using a Dockerfile OR
  • A BuildKit frontend is invoked with the RUN --mount command

Additionally, for the cleanup operations to impact the host file system the parent of the target directory needs to be replaced with a symbolic link during the build container's lifetime. For these reasons, this flaw was rated with an important severity.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.