CVE-2024-23650 BuildKit possible panic when incorrect parameters sent from frontend

What is CVE-2024-23650?

CVE-2024-23650 is a medium-severity vulnerability in moby buildkit, published on 31 Jan 2024.

Official description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.

Weakness: CWE-754

Which versions are affected by CVE-2024-23650?

3 open source packages ship an affected version, including github.com/moby/buildkit. It affects 1 product.

Products include Mobyproject Buildkit.

How do I fix CVE-2024-23650?

Upgrade github.com/moby/buildkit to 0.12.5 or later.

Is CVE-2024-23650 being exploited?

There is no known exploitation of CVE-2024-23650 in the wild and no public exploit code.

Other vulnerabilities in moby buildkit

• CVE-2024-23652 BuildKit possible host system access from mount stub cleaner Critical 10.0
• CVE-2024-23653 BuildKit interactive containers API does not validate entitlements check Critical 9.8
• CVE-2024-23651 BuildKit possible race condition with accessing subpaths from cache mounts High 8.7
• CVE-2026-33747 BuildKit vulnerable to malicious frontend causing file escape outside of storage root High 8.4
• CVE-2026-33748 BuildKit Git URL subdir component can cause access to restricted files High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-34080, AZL-34083, AZL-35003, AZL-35432, AZL-35438, BELL-CVE-2024-23650 and 5 more.