Cloudanix VulnDB

CVE-2024-23650

Medium · 5.3

CVSS

5.3

EPSS

1.1%

Published

Jan 31, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

Attackers could crash the build system with bad requests, halting software builds until the tool restarts.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A malicious BuildKit client or frontend crafts a request that triggers a panic in the BuildKit daemon, causing it to crash.

Why it matters to the business

Disrupts CI/CD build pipelines that depend on the affected toolkit, leading to downtime and delays in software delivery until the service restarts.

How an attack unfolds

An attacker supplies a malicious frontend from an untrusted source to send a specially crafted request that forces the BuildKit daemon into a panic state and terminates it.

How to fix it

Upgrade woodpecker-ci/woodpecker to the fixed commit 805c3156f857c228e9094a96619b4d00a5e6f711; as a workaround restrict BuildKit to trusted frontends only.

How to confirm the fix worked

Confirm the running BuildKit version matches or exceeds the fixed commit and attempt controlled requests from untrusted frontends to verify absence of crashes.

Typical attack path

  1. Locate an exposed BuildKit daemon accepting requests from untrusted frontends
  2. Craft and submit a malicious request designed to trigger a panic
  3. Observe daemon crash and resulting denial of service
  4. Repeat as needed to maintain disruption

How to detect it

Review BuildKit daemon logs for panic messages or unexpected crashes correlated with frontend requests from external or untrusted origins.

What your security team should do

  • Apply the fix commit immediately on all affected instances
  • Enforce policy to reject frontends from untrusted sources
  • Add monitoring for BuildKit daemon restarts and panic logs

The record

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/moby/buildkit 0 0.12.5
Chainguard buildctl 0 0.12.5-r0
Chainguard buildkitd 0 0.12.5-r0
Chainguard conftest 0 0.49.0-r1
Chainguard conftest-fips 0 0.48.0-r2
Chainguard datadog-agent 0 7.50.3-r1
Chainguard datadog-agent-core-integrations 0 7.50.3-r1
Chainguard datadog-agent-core-integrations-fips 0 7.50.3-r1
Chainguard datadog-agent-fakeintake 0 7.50.3-r1
Chainguard datadog-agent-fakeintake-fips 0 7.50.3-r1
Chainguard datadog-agent-fips 0 7.50.3-r1
Chainguard datadog-agent-jmx 0 7.50.3-r1
Chainguard datadog-agent-jmx-fips 0 7.50.3-r1
Chainguard datadog-agent-oci-compat 0 7.50.3-r1
Chainguard datadog-agent-oci-compat-fips 0 7.50.3-r1
Chainguard datadog-agent-s6-overlay 0 7.50.3-r1
Chainguard datadog-agent-s6-overlay-fips 0 7.50.3-r1
Chainguard datadog-cluster-agent 0 7.50.3-r1
Chainguard datadog-cluster-agent-fips 0 7.50.3-r1
Chainguard datadog-cluster-agent-oci-compat 0 7.50.3-r1
Chainguard datadog-cluster-agent-oci-compat-fips 0 7.50.3-r1
Chainguard docker 0 25.0.2-r0
Chainguard docker-config-mirror-gcr 0 25.0.2-r0
Chainguard docker-dind 0 25.0.2-r0
Chainguard docker-dind-compat 0 25.0.2-r0
Chainguard docker-init 0 25.0.2-r0
Chainguard docker-modprobe-compat 0 25.0.2-r0
Chainguard docker-oci-entrypoint 0 25.0.2-r0
Chainguard docker-rootless 0 25.0.2-r0
Chainguard dockerd 0 25.0.2-r0
Chainguard dockerd-oci-entrypoint 0 25.0.2-r0
Chainguard dockerd-service 0 25.0.2-r0
Chainguard dogstatsd 0 7.50.3-r1
Chainguard guac 0 0.4.0-r1
Chainguard guaccsub 0 0.4.0-r1
Chainguard guacgql 0 0.4.0-r1
Chainguard guacingest 0 0.4.0-r1
Chainguard guacone 0 0.4.0-r1
Chainguard kaniko 0 1.20.1-r0
Chainguard kaniko-compat 0 1.20.1-r0
Chainguard kaniko-warmer 0 1.20.1-r0
Chainguard kaniko-warmer-compat 0 1.20.1-r0
Chainguard kubescape 0 3.0.3-r7
Chainguard scorecard 0 4.13.1-r4
Chainguard skaffold 0 2.11.0-r0
Chainguard trivy 0 0.49.0-r1
Chainguard zot 0 2.0.1-r2
Red Hat:enterprise_linux:8::appstream aardvark-dns 0 2:1.10.0-1.module+el8.10.0+21209+52deeb51
Red Hat:enterprise_linux:8::appstream buildah 0 2:1.33.6-2.module+el8.10.0+21371+46937ece
Red Hat:enterprise_linux:8::appstream buildah-debuginfo 0 2:1.33.6-2.module+el8.10.0+21371+46937ece
Red Hat:enterprise_linux:8::appstream buildah-debugsource 0 2:1.33.6-2.module+el8.10.0+21371+46937ece
Red Hat:enterprise_linux:8::appstream buildah-tests 0 2:1.33.6-2.module+el8.10.0+21371+46937ece
Red Hat:enterprise_linux:8::appstream buildah-tests-debuginfo 0 2:1.33.6-2.module+el8.10.0+21371+46937ece
Red Hat:enterprise_linux:8::appstream cockpit-podman 0 0:84.1-1.module+el8.10.0+21373+0d273fdf
Red Hat:enterprise_linux:8::appstream conmon 0 3:2.1.10-1.module+el8.10.0+21077+98b84d8a
Red Hat:enterprise_linux:8::appstream conmon-debuginfo 0 3:2.1.10-1.module+el8.10.0+21077+98b84d8a
Red Hat:enterprise_linux:8::appstream conmon-debugsource 0 3:2.1.10-1.module+el8.10.0+21077+98b84d8a
Red Hat:enterprise_linux:8::appstream container-selinux 0 2:2.229.0-2.module+el8.10.0+21196+3f0abbca
Red Hat:enterprise_linux:8::appstream containernetworking-plugins 0 1:1.4.0-2.module+el8.10.0+21366+f9cb49f8
Red Hat:enterprise_linux:8::appstream containernetworking-plugins-debuginfo 0 1:1.4.0-2.module+el8.10.0+21366+f9cb49f8
Red Hat:enterprise_linux:8::appstream containernetworking-plugins-debugsource 0 1:1.4.0-2.module+el8.10.0+21366+f9cb49f8
Red Hat:enterprise_linux:8::appstream containers-common 0 2:1-81.module+el8.10.0+21340+c6c7475a
Red Hat:enterprise_linux:8::appstream crit 0 0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat:enterprise_linux:8::appstream criu 0 0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat:enterprise_linux:8::appstream criu-debuginfo 0 0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat:enterprise_linux:8::appstream criu-debugsource 0 0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat:enterprise_linux:8::appstream criu-devel 0 0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat:enterprise_linux:8::appstream criu-libs 0 0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat:enterprise_linux:8::appstream criu-libs-debuginfo 0 0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat:enterprise_linux:8::appstream crun 0 0:1.14.3-2.module+el8.10.0+21340+c6c7475a
Red Hat:enterprise_linux:8::appstream crun-debuginfo 0 0:1.14.3-2.module+el8.10.0+21340+c6c7475a
Red Hat:enterprise_linux:8::appstream crun-debugsource 0 0:1.14.3-2.module+el8.10.0+21340+c6c7475a
Red Hat:enterprise_linux:8::appstream fuse-overlayfs 0 0:1.13-1.module+el8.10.0+20412+95ee28e2
Red Hat:enterprise_linux:8::appstream fuse-overlayfs-debuginfo 0 0:1.13-1.module+el8.10.0+20412+95ee28e2
Red Hat:enterprise_linux:8::appstream fuse-overlayfs-debugsource 0 0:1.13-1.module+el8.10.0+20412+95ee28e2
Red Hat:enterprise_linux:8::appstream libslirp 0 0:4.4.0-1.module+el8.9.0+20326+387084d0
Red Hat:enterprise_linux:8::appstream libslirp-debuginfo 0 0:4.4.0-1.module+el8.9.0+20326+387084d0
Red Hat:enterprise_linux:8::appstream libslirp-debugsource 0 0:4.4.0-1.module+el8.9.0+20326+387084d0
Red Hat:enterprise_linux:8::appstream libslirp-devel 0 0:4.4.0-1.module+el8.9.0+20326+387084d0
Red Hat:enterprise_linux:8::appstream netavark 0 2:1.10.3-1.module+el8.10.0+21306+6be40ce7
Red Hat:enterprise_linux:8::appstream oci-seccomp-bpf-hook 0 0:1.2.10-1.module+el8.10.0+20565+a40ba0e5
Red Hat:enterprise_linux:8::appstream oci-seccomp-bpf-hook-debuginfo 0 0:1.2.10-1.module+el8.10.0+20565+a40ba0e5
Red Hat:enterprise_linux:8::appstream oci-seccomp-bpf-hook-debugsource 0 0:1.2.10-1.module+el8.10.0+20565+a40ba0e5
Red Hat:enterprise_linux:8::appstream podman 0 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat:enterprise_linux:8::appstream podman-catatonit 0 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat:enterprise_linux:8::appstream podman-catatonit-debuginfo 0 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat:enterprise_linux:8::appstream podman-debuginfo 0 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat:enterprise_linux:8::appstream podman-debugsource 0 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat:enterprise_linux:8::appstream podman-docker 0 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat:enterprise_linux:8::appstream podman-gvproxy 0 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat:enterprise_linux:8::appstream podman-gvproxy-debuginfo 0 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat:enterprise_linux:8::appstream podman-plugins 0 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat:enterprise_linux:8::appstream podman-plugins-debuginfo 0 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat:enterprise_linux:8::appstream podman-remote 0 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat:enterprise_linux:8::appstream podman-remote-debuginfo 0 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat:enterprise_linux:8::appstream podman-tests 0 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat:enterprise_linux:8::appstream python-podman 0 0:4.9.0-1.module+el8.10.0+21196+3f0abbca
Red Hat:enterprise_linux:8::appstream python3-criu 0 0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat:enterprise_linux:8::appstream python3-podman 0 0:4.9.0-1.module+el8.10.0+21196+3f0abbca
Red Hat:enterprise_linux:8::appstream runc 0 1:1.1.12-1.module+el8.10.0+21251+62b7388c
Red Hat:enterprise_linux:8::appstream runc-debuginfo 0 1:1.1.12-1.module+el8.10.0+21251+62b7388c
Red Hat:enterprise_linux:8::appstream runc-debugsource 0 1:1.1.12-1.module+el8.10.0+21251+62b7388c
Red Hat:enterprise_linux:8::appstream skopeo 0 2:1.14.3-0.1.module+el8.10.0+21251+62b7388c
Red Hat:enterprise_linux:8::appstream skopeo-tests 0 2:1.14.3-0.1.module+el8.10.0+21251+62b7388c
Red Hat:enterprise_linux:8::appstream slirp4netns 0 0:1.2.3-1.module+el8.10.0+21306+6be40ce7
Red Hat:enterprise_linux:8::appstream slirp4netns-debuginfo 0 0:1.2.3-1.module+el8.10.0+21306+6be40ce7
Red Hat:enterprise_linux:8::appstream slirp4netns-debugsource 0 0:1.2.3-1.module+el8.10.0+21306+6be40ce7
Red Hat:enterprise_linux:8::appstream toolbox 0 0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89
Red Hat:enterprise_linux:8::appstream toolbox-debuginfo 0 0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89
Red Hat:enterprise_linux:8::appstream toolbox-debugsource 0 0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89
Red Hat:enterprise_linux:8::appstream toolbox-tests 0 0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89
Red Hat:enterprise_linux:8::appstream udica 0 0:0.2.6-20.module+el8.9.0+20326+387084d0
SUSE:Enterprise Storage 7.1 docker 0 27.5.1_ce-150000.218.1
SUSE:Enterprise Storage 7.1 docker-stable 0 24.0.9_ce-150000.1.15.1
SUSE:Enterprise Storage 7.1 docker-stable 0 24.0.9_ce-150000.1.25.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS docker-stable 0 24.0.9_ce-150000.1.15.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS docker-stable 0 24.0.9_ce-150000.1.25.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS docker-stable 0 24.0.9_ce-150000.1.15.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS docker-stable 0 24.0.9_ce-150000.1.25.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS docker-stable 0 24.0.9_ce-150000.1.15.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS docker-stable 0 24.0.9_ce-150000.1.25.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS docker-stable 0 24.0.9_ce-150000.1.15.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS docker-stable 0 24.0.9_ce-150000.1.25.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS docker-stable 0 24.0.9_ce-150000.1.15.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS docker-stable 0 24.0.9_ce-150000.1.25.1
SUSE:Linux Enterprise Micro 5.1 docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise Micro 5.2 docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise Micro 5.3 docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise Micro 5.4 docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise Micro 5.5 docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise Module for Containers 15 SP6 docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise Module for Containers 15 SP6 docker-stable 0 24.0.9_ce-150000.1.11.1
SUSE:Linux Enterprise Module for Containers 15 SP6 docker-stable 0 24.0.9_ce-150000.1.15.1
SUSE:Linux Enterprise Module for Containers 15 SP6 docker-stable 0 24.0.9_ce-150000.1.25.1
SUSE:Linux Enterprise Module for Containers 15 SP7 docker-stable 0 24.0.9_ce-150000.1.25.1
SUSE:Linux Enterprise Module for Containers 15 SP7 docker-stable 0 24.0.9_ce-150000.1.39.1
SUSE:Linux Enterprise Server 12 SP5-LTSS docker 0 27.5.1_ce-98.126.1
SUSE:Linux Enterprise Server 12 SP5-LTSS docker-stable 0 24.0.9_ce-1.20.1
SUSE:Linux Enterprise Server 12 SP5-LTSS docker-stable 0 24.0.9_ce-1.11.1
SUSE:Linux Enterprise Server 15 SP3-LTSS docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise Server 15 SP3-LTSS docker-stable 0 24.0.9_ce-150000.1.15.1
SUSE:Linux Enterprise Server 15 SP3-LTSS docker-stable 0 24.0.9_ce-150000.1.25.1
SUSE:Linux Enterprise Server 15 SP4-LTSS docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise Server 15 SP4-LTSS docker-stable 0 24.0.9_ce-150000.1.15.1
SUSE:Linux Enterprise Server 15 SP4-LTSS docker-stable 0 24.0.9_ce-150000.1.25.1
SUSE:Linux Enterprise Server 15 SP5-LTSS docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise Server 15 SP5-LTSS docker-stable 0 24.0.9_ce-150000.1.15.1
SUSE:Linux Enterprise Server 15 SP5-LTSS docker-stable 0 24.0.9_ce-150000.1.25.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 docker 0 27.5.1_ce-98.126.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 docker-stable 0 24.0.9_ce-1.20.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 docker-stable 0 24.0.9_ce-1.11.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 docker-stable 0 24.0.9_ce-150000.1.15.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 docker-stable 0 24.0.9_ce-150000.1.25.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4 docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4 docker-stable 0 24.0.9_ce-150000.1.15.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4 docker-stable 0 24.0.9_ce-150000.1.25.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 docker 0 27.5.1_ce-150000.218.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 docker-stable 0 24.0.9_ce-150000.1.15.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 docker-stable 0 24.0.9_ce-150000.1.25.1
Ubuntu:20.04:LTS docker.io 0 No fix
Ubuntu:20.04:LTS docker.io-app 0 No fix
Ubuntu:22.04:LTS docker.io 0 No fix
Ubuntu:22.04:LTS docker.io-app 0 No fix
Ubuntu:22.04:LTS docker.io-app 0 27.5.1-0ubuntu3~22.04.2
Ubuntu:24.04:LTS docker.io 0 No fix
Ubuntu:24.04:LTS docker.io-app 0 No fix
Ubuntu:24.04:LTS docker.io-app 0 27.5.1-0ubuntu3~24.04.2
Ubuntu:24.10 docker.io 0 No fix
Ubuntu:24.10 docker.io-app 0 No fix
Ubuntu:25.04 docker.io 0 No fix
Ubuntu:25.04 docker.io-app 0 No fix
Ubuntu:25.10 docker.io 0 No fix
Ubuntu:25.10 docker.io-app 0 No fix
Ubuntu:Pro:18.04:LTS docker.io 0 No fix
Ubuntu:Pro:20.04:LTS docker.io-app 0 No fix
Ubuntu:Pro:20.04:LTS docker.io-app 0 26.1.3-0ubuntu1~20.04.1+esm1
Wolfi buildctl 0 0.12.5-r0
Wolfi buildkitd 0 0.12.5-r0
Wolfi conftest 0 0.49.0-r1
Wolfi datadog-agent 0 7.50.3-r1
Wolfi datadog-agent-core-integrations 0 7.50.3-r1
Wolfi datadog-agent-fakeintake 0 7.50.3-r1
Wolfi datadog-agent-jmx 0 7.50.3-r1
Wolfi datadog-agent-oci-compat 0 7.50.3-r1
Wolfi datadog-agent-s6-overlay 0 7.50.3-r1
Wolfi datadog-cluster-agent 0 7.50.3-r1
Wolfi datadog-cluster-agent-oci-compat 0 7.50.3-r1
Wolfi docker 0 25.0.2-r0
Wolfi docker-config-mirror-gcr 0 25.0.2-r0
Wolfi docker-dind 0 25.0.2-r0
Wolfi docker-dind-compat 0 25.0.2-r0
Wolfi docker-init 0 25.0.2-r0
Wolfi docker-modprobe-compat 0 25.0.2-r0
Wolfi docker-oci-entrypoint 0 25.0.2-r0

Related vulnerabilities