x/vulndb: potential Go vuln in github.com/moby/buildkit: CVE-2024-23653

[GoVulnBot]

CVE-2024-23653 references github.com/moby/buildkit, which may be a Go module.

Description:
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special security.insecure entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-23653
• JSON: https://github.com/CVEProject/cvelist/tree/ee90e4ba1fff51febd6b16e888afac6a14a162ac/2024/23xxx/CVE-2024-23653.json
• advisory: GHSA-wr6v-9f75-vh2g
• fix: llbsolver: make sure interactive container API validates entitlements moby/buildkit#4602
• web: https://github.com/moby/buildkit/releases/tag/v0.12.5
• Imported by: https://pkg.go.dev/github.com/moby/buildkit?tab=importedby

Cross references:

• Module github.com/moby/buildkit appears in issue x/vulndb: potential Go vuln in github.com/moby/buildkit: CVE-2023-26054 #1609 EFFECTIVELY_PRIVATE
• Module github.com/moby/buildkit appears in issue x/vulndb: potential Go vuln in github.com/moby/buildkit: CVE-2020-27534 #2296 LEGACY_FALSE_POSITIVE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/moby/buildkit
      vulnerable_at: 0.12.5
      packages:
        - package: buildkit
cves:
    - CVE-2024-23653
references:
    - advisory: https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g
    - fix: https://github.com/moby/buildkit/pull/4602
    - web: https://github.com/moby/buildkit/releases/tag/v0.12.5

[timothy-king]

Duplicate of #2497

[gopherbot]

Change https://go.dev/cl/562238 mentions this issue: data/reports: add GO-2024-2497.yaml