CVE-2024-23652

What it actually does

Path traversal flaw in BuildKit's RUN --mount handling allows a malicious frontend or Dockerfile to cause deletion of arbitrary files on the host filesystem outside the build container by tricking the empty file removal logic for mountpoints.

Why it matters to the business

Attackers can cause data loss, configuration corruption, or service disruption on build hosts that process untrusted Dockerfiles or frontends, potentially halting CI/CD pipelines and requiring recovery from backups.

How an attack unfolds

An attacker crafts a malicious Dockerfile or BuildKit frontend containing a specially formed RUN --mount directive. When BuildKit processes the build on a vulnerable host, the mountpoint cleanup logic follows a manipulated path and deletes a chosen file from the host system instead of only inside the container.

How to fix it

Upgrade moby/buildkit to the commit bac3f2b673f3f9d33e79046008e7a38e856b3dc6 or later release v0.12.5. As a workaround, refuse builds that use untrusted frontends or Dockerfiles containing the RUN --mount feature.

How to confirm the fix worked

Verify the installed BuildKit binary or source reports version 0.12.5 or newer containing commit bac3f2b673f3f9d33e79046008e7a38e856b3dc6. Re-run representative builds with RUN --mount directives and confirm no host files outside the container are affected.

Typical attack path

1. Obtain or create a malicious BuildKit frontend or Dockerfile that abuses RUN --mount
2. Submit the artifact to a BuildKit instance running on a target host
3. Trigger the build so the mountpoint removal code executes the crafted path
4. Observe or confirm deletion of the targeted host file outside the container

How to detect it

Inspect BuildKit build logs for RUN --mount operations that reference paths outside expected container boundaries and correlate with subsequent host filesystem deletion events in system audit logs.

What your security team should do

• Immediately update all BuildKit deployments to the fixed commit or v0.12.5
• Implement policy to block builds from untrusted frontends or Dockerfiles using RUN --mount until patched
• Monitor build logs and host filesystem changes during CI/CD jobs for unexpected file deletions
• Review and restrict access to BuildKit endpoints that accept arbitrary Dockerfiles