CVE-2024-23652: Mobyproject BuildKit Path Traversal Flaw

CVE-2024-23652 Overview

CVE-2024-23652 is a critical path traversal vulnerability in BuildKit, the modern toolkit for converting source code to build artifacts used by Docker and other container build systems. A malicious BuildKit frontend or Dockerfile using the RUN --mount directive can exploit the empty file cleanup mechanism to delete arbitrary files on the host system outside of the container boundary.

Critical Impact

This vulnerability enables container escape scenarios where an attacker can delete arbitrary files on the host system by exploiting the mountpoint cleanup feature, potentially leading to denial of service or system compromise.

Affected Products

• Mobyproject BuildKit versions prior to v0.12.5

Discovery Timeline

• 2024-01-31 - CVE-2024-23652 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-23652

Vulnerability Analysis

This vulnerability falls under CWE-22 (Path Traversal), which allows attackers to access or manipulate files outside of intended directory boundaries. The flaw exists in BuildKit's handling of the RUN --mount feature, specifically in the cleanup mechanism responsible for removing empty files created as mountpoints during the build process.

When BuildKit processes a RUN --mount instruction in a Dockerfile, it creates temporary mountpoints within the container filesystem. After the build step completes, BuildKit performs cleanup operations to remove these empty placeholder files. However, insufficient path validation in this cleanup routine allows a maliciously crafted frontend or Dockerfile to specify paths that escape the container boundary.

An attacker who can supply a malicious Dockerfile or BuildKit frontend can craft RUN --mount directives with specially constructed paths containing traversal sequences. When the cleanup routine processes these paths, it follows the traversal and deletes files on the host system instead of within the container context.

Root Cause

The root cause is insufficient path validation in BuildKit's mountpoint cleanup mechanism. The cleanup routine fails to properly canonicalize and validate file paths before performing deletion operations, allowing path traversal sequences to escape the intended container filesystem scope.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. The attack vector requires the victim to build a malicious Dockerfile or use an untrusted BuildKit frontend. Organizations that accept and build untrusted Dockerfiles, such as CI/CD systems processing external contributions, are particularly at risk.

The attack scenario involves:

1. An attacker crafts a malicious Dockerfile containing RUN --mount directives with path traversal sequences
2. A victim system builds the malicious Dockerfile using vulnerable BuildKit
3. During the cleanup phase, BuildKit follows the traversal path and deletes files on the host system
4. Depending on the targeted files, this can lead to denial of service, privilege escalation, or further system compromise

Detection Methods for CVE-2024-23652

Indicators of Compromise

• Unexpected file deletions on systems running BuildKit build operations
• Dockerfiles or BuildKit frontends containing suspicious RUN --mount directives with traversal patterns (e.g., ../ sequences)
• Anomalous file system activity during container build processes
• Build logs showing unusual mount paths or cleanup operations

Detection Strategies

• Monitor BuildKit build logs for RUN --mount directives containing path traversal sequences such as ../ or absolute paths outside container scope
• Implement file integrity monitoring on critical host system files that could be targeted for deletion
• Audit incoming Dockerfiles for suspicious mount configurations before building
• Deploy container security tools that can analyze Dockerfile contents for potentially malicious instructions

Monitoring Recommendations

• Enable detailed BuildKit logging and forward logs to SIEM for analysis
• Configure alerts for file deletion events on host systems during active build operations
• Implement baseline monitoring for critical system files and directories
• Monitor for BuildKit frontend downloads from untrusted sources

How to Mitigate CVE-2024-23652

Immediate Actions Required

• Upgrade BuildKit to version v0.12.5 or later immediately
• Audit all Dockerfiles in your environment for suspicious RUN --mount usage
• Restrict access to build systems to prevent execution of untrusted Dockerfiles
• Implement Dockerfile scanning in CI/CD pipelines to detect potentially malicious instructions

Patch Information

The BuildKit team has released version v0.12.5 which addresses this vulnerability. The fix includes proper path validation in the mountpoint cleanup mechanism to prevent traversal outside container boundaries.

Upgrade to the patched version using the appropriate method for your environment:

• GitHub Release v0.12.5 - Official release with security fix
• GitHub Pull Request Discussion - Technical details of the fix
• GitHub Security Advisory GHSA-4v98-7qmw-rqr8 - Full security advisory

Workarounds

• Avoid using BuildKit frontends from untrusted sources
• Do not build Dockerfiles containing RUN --mount features from untrusted sources
• Implement strict access controls on build systems to prevent execution of arbitrary Dockerfiles
• Consider running BuildKit in isolated environments with limited host filesystem access until patching is complete

# Verify BuildKit version to ensure patched version is installed
buildctl --version
# Expected output should show v0.12.5 or later

# For Docker users, verify buildx version which includes BuildKit
docker buildx version