SNYK-GOLANG-GITHUBCOMMOBYBUILDKITEXECUTOROCI-6209338
Record from snyk · Published January 31, 2024
github.com/moby/buildkit/executor/oci is fixed in 0.12.5 (Go Modules)
## Overview Affected versions of this package are vulnerable to Race Condition (Leaky Vessels) in the subpath mounting when two malicious build steps are running in parallel and sharing the same cache mounts. This can lead to files from the host system being accessible to the build container. ## Workaround Avoid using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with `--mount=type=cache,source=...` options. *This vulnerability was discovered and responsibly disclosed as part of the [Leaky Vessels](https://snyk.io/blog/leaky-vessels-docker-runc-container-breakout-vulnerabilities/) project.* ## Remediation Upgrade `github.com/moby/buildkit/executor/oci` to version 0.12.5 or higher. ## References - [GitHub Commit](https://github.com/moby/buildkit/commit/f781267af1acb688e94740e1fdc22c1bf587d7fd) - [OSS Security List](https://www.openwall.com/lists/oss-security/2019/05/28/1) - [Snyk Blog Post](https://snyk.io/blog/cve-2024-23651-docker-buildkit-mount-cache-race-build-time-race-condition-container-breakout/)
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/moby/buildkit/executor/oci | Go Modules | 0.12.5 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| 0 |
Timeline
- Dec 11, 2023 CVE Updated
- Jan 31, 2024 CVE Published
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln SNYK-GOLANG-GITHUBCOMMOBYBUILDKITEXECUTOROCI-6209338
vulnetix vdb fixes SNYK-GOLANG-GITHUBCOMMOBYBUILDKITEXECUTOROCI-6209338Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/SNYK-GOLANG-GITHUBCOMMOBYBUILDKITEXECUTOROCI-6209338/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://learn.snyk.io/lesson/race-condition/ technical
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMOBYBUILDKITEXECUTOROCI-6209338 advisory
- https://snyk.io/blog/leaky-vessels-docker-runc-container-breakout-vulnerabilities/ technical
- https://github.com/moby/buildkit/commit/f781267af1acb688e94740e1fdc22c1bf587d7fd patch
- https://www.openwall.com/lists/oss-security/2019/05/28/1 technical
- https://snyk.io/blog/cve-2024-23651-docker-buildkit-mount-cache-race-build-time-race-condition-container-breakout/ technical