SNYK-GOLANG-GITHUBCOMMOBYBUILDKITFRONTEND-6209358: github.com/moby/buildkit/frontend fixed in 0.12.5

SNYK-GOLANG-GITHUBCOMMOBYBUILDKITFRONTEND-6209358 PUBLISHED CVSS 7.900000095367432 HIGH

Record from snyk · Published January 31, 2024

github.com/moby/buildkit/frontend is fixed in 0.12.5 (Go Modules)

## Overview Affected versions of this package are vulnerable to Improper Handling of Insufficient Privileges (Leaky Vessels) via APIs for running interactive containers based on built images. It is possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special security.insecure entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. ## Workaround Avoid using BuildKit frontends from untrusted sources. A frontend image is usually specified as the `#syntax` line in the Dockerfile, or with the `--frontend` flag when using the `buildctl build` command. *This vulnerability was discovered and responsibly disclosed as part of the [Leaky Vessels](https://snyk.io/blog/leaky-vessels-docker-runc-container-breakout-vulnerabilities/) project.* ## Remediation Upgrade `github.com/moby/buildkit/frontend` to version 0.12.5 or higher. ## References - [GitHub Commit](https://github.com/moby/buildkit/commit/5026d95aa3336e97cfe46e3764f52d08bac7a10e) - [GitHub Commit](https://github.com/moby/buildkit/commit/92cc595cfb12891d4b3ae476e067c74250e4b71e) - [Snyk Blog Post](https://snyk.io/blog/cve-2024-23653-buildkit-grpc-securitymode-privilege-check/)

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
github.com/moby/buildkit/frontend	Go Modules	0.12.5

Risk scores

CVSS 3.1

7.900000095367432

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P

Affected products

Vendor	Product	Versions
		0

Timeline

Dec 11, 2023 CVE Updated
Jan 31, 2024 CVE Published

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln SNYK-GOLANG-GITHUBCOMMOBYBUILDKITFRONTEND-6209358
vulnetix vdb fixes SNYK-GOLANG-GITHUBCOMMOBYBUILDKITFRONTEND-6209358

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/SNYK-GOLANG-GITHUBCOMMOBYBUILDKITFRONTEND-6209358/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →