CVE-2024-23653
Published: 31 January 2024
Summary
CVE-2024-23653 is a critical-severity Incorrect Authorization (CWE-863) vulnerability in Mobyproject Buildkit. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
BuildKit is a toolkit for converting source code to build artifacts that also exposes APIs for running interactive containers based on built images. The vulnerability allows these APIs to be used to launch containers with elevated privileges even when the security.insecure entitlement has not been enabled in the buildkitd configuration and has not been granted by the user submitting the build request. The flaw is tracked as CWE-863 and carries a CVSS 3.1 score of 9.8.
An attacker with network access to a BuildKit instance can submit build requests that invoke the affected APIs, thereby obtaining privileged containers without any user interaction or special entitlements. Successful exploitation grants full control over confidentiality, integrity, and availability of the build environment.
The vulnerability was corrected in BuildKit v0.12.5. The project advisory and release notes recommend avoiding BuildKit frontends obtained from untrusted sources and upgrading to the patched version. The associated EPSS score has remained near 0.10 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0453
Vulnerability details
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was…
more
possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Periodic review and update of procedures reduces incorrect authorization implementations over time.
Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.
Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.
The authorization process and usage restrictions help prevent incorrect authorization for remote access types.
Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.
Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.
Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.
Ensures authorization decisions for external system use are correctly implemented and enforced.