CVE-2024-23651

A race condition issue was found in the Moby Builder Toolkit, stemming from a time-of-check/time-of-use (TOCTOU) vulnerability during cache volume mounting at container build time. Concurrent execution of two malicious build steps, sharing the same cache mounts with subpaths, may result in files from the host system being accessible to the build container. Successful exploitation could lead to a container escape to the underlying host OS when building an image using a malicious Dockerfile or upstream image (for example, when using FROM).

This vulnerability can only be exploited when two containers are being built in parallel within the same cache directory. A concurrent running build that has the target cache directory mounted, needs to replace the target directory with a symbolic link between the time it is checked and actually used. As there is an unpredictable race condition, this issue is difficult to exploit. Therefore it is rated as having Moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not use BuildKit frontends or Dockerfiles from untrusted sources.