Skip to content
Fencer Vulns
medium 5.3

CVE-2024-23650 json

BuildKit possible panic when incorrect parameters sent from frontend

published 2024-01-31 2 y ago modified 2026-09-10 1 mo ago also GHSA-9p26-698r-w4hx , GO-2024-2492 , EUVD-2024-0315

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.

Patch / fix

  • go github.com/moby/buildkit 0.12.5
  • moby buildkit 0.12.5
  • docker.io-app Ubuntu 22.04 LTS 27.5.1-0ubuntu3~22.04.2
  • docker.io-app Ubuntu 24.04 LTS 27.5.1-0ubuntu3~24.04.2
  • docker.io-app Ubuntu Pro 20.04 LTS 26.1.3-0ubuntu1~20.04.1+esm1

ubuntu advisories UBUNTU-CVE-2024-23650

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • crit RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
  • criu RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
  • crun RHEL 8 1.14.3-2.module+el8.10.0+21340+c6c7475a
  • runc RHEL 8 1:1.1.12-1.module+el8.10.0+21251+62b7388c
  • udica RHEL 8 0.2.6-20.module+el8.9.0+20326+387084d0
  • conmon RHEL 8 3:2.1.10-1.module+el8.10.0+21077+98b84d8a
  • podman RHEL 8 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
  • skopeo RHEL 8 2:1.14.3-0.1.module+el8.10.0+21251+62b7388c

red hat advisories RHSA-2024:2988

  • docker-stable SLE Module for Containers 15 SP7, openSUSE Leap 15.6 24.0.9_ce-150000.1.39.1
  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 24.0.9_ce-150000.1.25.1
  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +11 more 24.0.9_ce-150000.1.15.1
  • docker SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +16 more 27.5.1_ce-150000.218.1
  • docker-stable SLE Module for Containers 15 SP6, openSUSE Leap 15.6 24.0.9_ce-150000.1.11.1
  • docker-stable SLES LTSS Extended Security 12 SP5 24.0.9_ce-1.32.1
  • docker-stable SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 24.0.9_ce-1.20.1
  • docker-stable SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 24.0.9_ce-1.11.1

suse advisories SUSE-SU-2026:1118-1SUSE-SU-2026:0972-1SUSE-SU-2025:03545-1SUSE-SU-2025:03540-1SUSE-SU-2025:1102-1SUSE-SU-2025:1062-1

  • docker-stable openSUSE Tumbleweed 24.0.9_ce-6.1
  • singularity-ce openSUSE Tumbleweed 4.1.3-1.1

opensuse advisories openSUSE-SU-2024:14598-1openSUSE-SU-2024:14059-1

  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1815+5fe7415e
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1825+623b0c20
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1843+6892ab28
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1872+2e18eb19
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1874+ce489889
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1880+8e896d1b
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1896+b18fa106
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1948+4b5cd4a9

rocky linux advisories RLSA-2024:2988

  • docker Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 25.0.2-r0
  • buildkit Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 0.12.5-r0
  • singularity Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 4.1.1-r0

alpine advisories ALPINE-CVE-2024-23650

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • moby-compose CBL-Mariner 2.0 2.17.3-5
  • moby-engine CBL-Mariner 2.0 24.0.9-14
  • moby-engine Azure Linux 3.0 25.0.3-1
  • docker-buildx Azure Linux 3.0 0.14.0-1
  • docker-compose Azure Linux 3.0 2.27.0-1

azure linux advisories AZL-34080AZL-34083AZL-35003AZL-35432AZL-35438

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-23650 updated cvss 5.3

moby/buildkit: Possible race condition with accessing subpaths from cache mounts

  • Red Hat OpenShift Developer Tools and Services odo Red Hat OpenShift Container Platform 4 openshift-clients, openshift-clients-redistributable Red Hat OpenShift Dev Spaces devspaces/traefik-rhel8 Red Hat Quay 3 quay/quay-builder-rhel8
    affected: workaround, no fix available “Avoid using untrusted input for the client or frontend syntax to minimize the vulnerability exploration.”
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.18-4.module+el8.9.0+20326+387084d0, criu 3.18-4.module+el8.9.0+20326+387084d0, crun 1.14.3-2.module+el8.10.0+21340+c6c7475a, runc 1.1.12-1.module+el8.10.0+21251+62b7388c, udica 0.2.6-20.module+el8.9.0+20326+387084d0, conmon 2.1.10-1.module+el8.10.0+21077+98b84d8a, +27 more
    fixed: vendor fix “Avoid using untrusted input for the client or frontend syntax to minimize the vulnerability exploration.” RHSA-2024:2988
  • Red Hat OpenShift Serverless openshift-serverless-clients, openshift-serverless-1/kn-client-kn-rhel9 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-cni-rhel8 Red Hat Ansible Automation Platform 1.2 openshift-clients Red Hat Enterprise Linux 9 podman, buildah, podman-tests, buildah-tests, podman-docker, podman-remote, +3 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
23 mo ago

Exploit prediction

1.14% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
go github.com/moby/buildkit
<0.12.5
0.12.5

Affected products

  • moby buildkit

Classification

Weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.