CVE-2024-23653

Description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
docker.io	25.10 questing	Not affected
	25.04 plucky	Ignored end of life, was needed
	24.10 oracular	Ignored end of life, was needed
	24.04 LTS noble	Vulnerable
	23.10 mantic	Ignored end of life, was needed
	22.04 LTS jammy	Vulnerable
	20.04 LTS focal	Vulnerable
	18.04 LTS bionic	Vulnerable
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Ignored end of standard support
docker.io-app	25.10 questing	Not affected
	25.04 plucky	Not affected
	24.10 oracular	Ignored end of life, was needed
	24.04 LTS noble	Fixed 27.5.1-0ubuntu3~24.04.2
	23.10 mantic	Ignored end of life, was needed
	22.04 LTS jammy	Fixed 27.5.1-0ubuntu3~22.04.2
	20.04 LTS focal	Fixed 26.1.3-0ubuntu1~20.04.1+esm1
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Ignored end of standard support

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Notes

alexmurray

Traditionally the docker.io source package contained both the library and docker application. However, in releases that contain the docker.io-app source package, the docker.io source package contains only the library whilst the docker application itself is contained in the docker.io-app package.

sbeattie

docker packages contain an embedded copy of github:moby/buildkit

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
docker.io	Upstream: https://github.com/moby/buildkit/pull/4602/commits/65c3c9c135cba5c9e28d646e85b3c77fa93bbf0c Upstream: https://github.com/moby/buildkit/pull/4602/commits/0c5daa23277e9e1fa8b2d794903cd97df95496fb

Severity score breakdown

Parameter	Value
Base score	9.8 · Critical
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H