CVE-2024-23653
Description
A vulnerability was found in the Moby Builder Toolkit, specifically in the Interactive Containers API, where entitlement checks are not adequately validated, caused by a missing privilege check in a GRPC endpoint when called using a custom syntax format. This flaw allows the currently running privileged container to leverage its elevated privileges, such as full Linux capabilities, to break out of the container and achieve complete host root command execution. This issue may lead to container escape to the underlying host OS when building an image using a malicious Dockerfile or upstream image (for example, when using FROM).
Statement
This vulnerability can only be exploited when a container execution is part of the build steps of another container. Additionally, an attacker needs to trick a user or process into processing an malicious Buildkit frontend. For these reasons, this flaw was rated with an important severity. The risk of this vulnerability is to systems which build containers. It could have significant consequences to an organization's ability to release new versions of their software.
Red Hat has reviewed and removed previously listed "Not Affected" components from this CVE page to reduce confusion around containers/components
Mitigation
Do not use BuildKit frontends from untrusted sources.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data; Read Files or Directories
An attacker could bypass intended access restrictions to read sensitive data, either by reading the data directly from a data store that is not correctly restricted, or by accessing insufficiently-protected, privileged functionality to read the data.
Integrity
Technical Impact: Modify Application Data; Modify Files or Directories
An attacker could bypass intended access restrictions to modify sensitive data, either by writing the data directly to a data store that is not correctly restricted, or by accessing insufficiently-protected, privileged functionality to write the data.
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
An attacker could bypass intended access restrictions to gain privileges by modifying or reading critical data directly, or by accessing privileged functionality.
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
An attacker could use elevated privileges to execute unauthorized commands or code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
An attacker could gain unauthorized access to resources on the system and excessively consume those resources, leading to a denial of service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
