CVE-2024-23653

What it actually does

Authorization bypass in BuildKit that permits APIs to spawn containers with elevated privileges without requiring the security.insecure entitlement in both daemon configuration and build request.

Why it matters to the business

Attackers can obtain full control over build pipelines and artifacts, enabling supply-chain compromise, intellectual-property theft, or deployment of malicious code in downstream systems.

How an attack unfolds

An attacker sends a build request to a reachable BuildKit instance that invokes the interactive container APIs, requesting a privileged container; the missing entitlement checks allow the request to succeed and the attacker gains an elevated-privilege shell inside the build environment.

How to fix it

Upgrade moby/buildkit to v0.12.5 or later (commit bac3f2b673f3f9d33e79046008e7a38e856b3dc6). Avoid using BuildKit frontends from untrusted sources until the upgrade is complete.

How to confirm the fix worked

Confirm the installed BuildKit binary reports version 0.12.5 or newer; review buildkitd configuration to ensure security.insecure is disabled by default; run a test build that attempts privileged container creation and verify it is rejected.

Typical attack path

1. Identify an exposed BuildKit daemon or frontend accepting build requests from untrusted sources
2. Craft a build request that exercises the interactive-container APIs while requesting elevated privileges
3. Submit the request; the missing entitlement validation permits the container to start with root-level capabilities
4. Use the resulting privileged container to inspect host resources, exfiltrate secrets, or inject malicious build steps

How to detect it

Search BuildKit daemon logs for build requests that specify privileged options or reference the interactive-container APIs; look for unexpected privileged container creation events in container runtime audit logs around the time of build activity.

What your security team should do

• Immediately upgrade all BuildKit deployments to the fixed version
• Audit build pipelines for use of untrusted frontends and remove or isolate them
• Enable logging of build requests and privileged-container attempts for future monitoring
• Review CI/CD systems that embed BuildKit for exposure to external build contexts