Bug 1219438 (CVE-2024-23653) - VUL-0: CVE-2024-23653: buildkit: BuildKit API doesn't validate entitlement on container creation
Summary: VUL-0: CVE-2024-23653: buildkit: BuildKit API doesn't validate entitlement on...
Status: REOPENED
Alias: CVE-2024-23653
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Danish Prakash
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/392683/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-23653:7.0:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-02-01 10:27 UTC by SMASH SMASH
Modified: 2024-06-04 07:57 UTC (History)
7 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-02-01 10:27:31 UTC
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-23653
https://github.com/moby/buildkit/releases/tag/v0.12.5
https://www.cve.org/CVERecord?id=CVE-2024-23653
https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g

Patch:
https://github.com/moby/buildkit/pull/4602
Comment 1 Andrea Mattiazzo 2024-02-01 10:28:04 UTC
Tracking as affected:
- SUSE:ALP:Source:Standard:1.0
 - openSUSE:Factory
Comment 2 Gianluca Gabrielli 2024-02-08 09:50:04 UTC
The following packages are also affected, as they embed BuildKit.
 - SUSE:ALP:Source:Standard:1.0/docker
 - SUSE:SLE-12:Update/docker
 - SUSE:SLE-15:Update/docker
 - openSUSE:Factory/docker

@containers-team please submit the patch for them.
Comment 6 Maintenance Automation 2024-02-22 12:30:09 UTC
SUSE-SU-2024:0587-1: An update that solves three vulnerabilities can now be installed.

Category: security (important)
Bug References: 1219267, 1219268, 1219438
CVE References: CVE-2024-23651, CVE-2024-23652, CVE-2024-23653
Sources used:
Containers Module 12 (src): docker-24.0.7_ce-98.106.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Maintenance Automation 2024-02-22 12:30:10 UTC
SUSE-SU-2024:0586-1: An update that solves three vulnerabilities can now be installed.

Category: security (important)
Bug References: 1219267, 1219268, 1219438
CVE References: CVE-2024-23651, CVE-2024-23652, CVE-2024-23653
Sources used:
openSUSE Leap Micro 5.3 (src): docker-24.0.7_ce-150000.193.1
openSUSE Leap Micro 5.4 (src): docker-24.0.7_ce-150000.193.1
openSUSE Leap 15.5 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise Micro 5.3 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise Micro 5.4 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise Micro 5.5 (src): docker-24.0.7_ce-150000.193.1
Containers Module 15-SP4 (src): docker-24.0.7_ce-150000.193.1
Containers Module 15-SP5 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): docker-24.0.7_ce-150000.193.1
SUSE Enterprise Storage 7.1 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise Micro 5.1 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise Micro 5.2 (src): docker-24.0.7_ce-150000.193.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): docker-24.0.7_ce-150000.193.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Maintenance Automation 2024-04-04 16:30:20 UTC
SUSE-SU-2024:0586-2: An update that solves three vulnerabilities can now be installed.

Category: security (important)
Bug References: 1219267, 1219268, 1219438
CVE References: CVE-2024-23651, CVE-2024-23652, CVE-2024-23653
Maintenance Incident: [SUSE:Maintenance:32641](https://smelt.suse.de/incident/32641/)
Sources used:
Containers Module 15-SP4 (src):
 docker-24.0.7_ce-150000.193.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Maintenance Automation 2024-04-29 16:30:35 UTC
SUSE-SU-2024:1469-1: An update that solves three vulnerabilities and has one security fix can now be installed.

Category: security (important)
Bug References: 1219267, 1219268, 1219438, 1223409
CVE References: CVE-2024-23651, CVE-2024-23652, CVE-2024-23653
Maintenance Incident: [SUSE:Maintenance:33586](https://smelt.suse.de/incident/33586/)
Sources used:
Containers Module 12 (src):
 docker-25.0.5_ce-98.112.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.