CVE-2024-23650: 
Docker vulnerability analysis and mitigation

CVE-2024-23650 is a security vulnerability discovered in BuildKit, a toolkit for converting source code to build artifacts. The vulnerability was disclosed on January 31, 2024, affecting BuildKit versions <=v0.12.4. The issue impacts the BuildKit daemon and could be triggered by malicious BuildKit clients or frontends (GitHub Advisory).

The vulnerability is rated with a CVSS 3.1 base score of 5.3 (Medium), with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None, Scope: Unchanged, Confidentiality: None, Integrity: None, Availability: Low. The technical issue involves a possible race condition with accessing subpaths from cache mounts, which could lead to the BuildKit daemon crashing with a panic when processing incorrect parameters sent from a frontend (Ubuntu Security).

When exploited, this vulnerability can cause a denial of service condition by crashing the BuildKit daemon. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (Ubuntu Security).

The vulnerability has been patched in BuildKit version v0.12.5. As a workaround, users are advised to avoid using BuildKit frontends from untrusted sources. A frontend image is typically specified as the #syntax line in Dockerfile or with the --frontend flag when using the buildctl build command (GitHub Release).