CVE-2024-23650
moby/buildkit: Possible race condition with accessing subpaths from cache mounts
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · January 31, 2024
Updated · July 3, 2026
Description
A vulnerability was found in the Moby Builder Toolkit. A malicious BuildKit client or any frontend that can craft a request could lead to the BuildKit daemon crashing with a panic due to the lack of input validation. A frontend is usually specified as the #syntax line on a Dockerfile or with the --frontend flag when using the buildctl build command.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Avoid using untrusted input for the client or frontend syntax to minimize the vulnerability exploration.
CVSS / CWE
CVSS 3.1 · 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-754 · Improper Check for Unusual or Exceptional Conditions