Bugzilla – Bug 1219438
VUL-0: CVE-2024-23653: buildkit: BuildKit API doesn't validate entitlement on container creation
Last modified: 2024-06-04 07:57:26 UTC
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-23653 https://github.com/moby/buildkit/releases/tag/v0.12.5 https://www.cve.org/CVERecord?id=CVE-2024-23653 https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g Patch: https://github.com/moby/buildkit/pull/4602
Tracking as affected: - SUSE:ALP:Source:Standard:1.0 - openSUSE:Factory
The following packages are also affected, as they embed BuildKit. - SUSE:ALP:Source:Standard:1.0/docker - SUSE:SLE-12:Update/docker - SUSE:SLE-15:Update/docker - openSUSE:Factory/docker @containers-team please submit the patch for them.
SUSE-SU-2024:0587-1: An update that solves three vulnerabilities can now be installed. Category: security (important) Bug References: 1219267, 1219268, 1219438 CVE References: CVE-2024-23651, CVE-2024-23652, CVE-2024-23653 Sources used: Containers Module 12 (src): docker-24.0.7_ce-98.106.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:0586-1: An update that solves three vulnerabilities can now be installed. Category: security (important) Bug References: 1219267, 1219268, 1219438 CVE References: CVE-2024-23651, CVE-2024-23652, CVE-2024-23653 Sources used: openSUSE Leap Micro 5.3 (src): docker-24.0.7_ce-150000.193.1 openSUSE Leap Micro 5.4 (src): docker-24.0.7_ce-150000.193.1 openSUSE Leap 15.5 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise Micro for Rancher 5.3 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise Micro 5.3 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise Micro for Rancher 5.4 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise Micro 5.4 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise Micro 5.5 (src): docker-24.0.7_ce-150000.193.1 Containers Module 15-SP4 (src): docker-24.0.7_ce-150000.193.1 Containers Module 15-SP5 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): docker-24.0.7_ce-150000.193.1 SUSE Enterprise Storage 7.1 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise Micro 5.1 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise Micro 5.2 (src): docker-24.0.7_ce-150000.193.1 SUSE Linux Enterprise Micro for Rancher 5.2 (src): docker-24.0.7_ce-150000.193.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:0586-2: An update that solves three vulnerabilities can now be installed. Category: security (important) Bug References: 1219267, 1219268, 1219438 CVE References: CVE-2024-23651, CVE-2024-23652, CVE-2024-23653 Maintenance Incident: [SUSE:Maintenance:32641](https://smelt.suse.de/incident/32641/) Sources used: Containers Module 15-SP4 (src): docker-24.0.7_ce-150000.193.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1469-1: An update that solves three vulnerabilities and has one security fix can now be installed. Category: security (important) Bug References: 1219267, 1219268, 1219438, 1223409 CVE References: CVE-2024-23651, CVE-2024-23652, CVE-2024-23653 Maintenance Incident: [SUSE:Maintenance:33586](https://smelt.suse.de/incident/33586/) Sources used: Containers Module 12 (src): docker-25.0.5_ce-98.112.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.