CVE-2024-23651: 
Docker vulnerability analysis and mitigation

CVE-2024-23651 is a high-severity vulnerability (CVSS score: 8.7) discovered in BuildKit, a toolkit for converting source code to build artifacts. The vulnerability affects all versions of BuildKit <=v0.12.4 and was disclosed in January 2024. The issue stems from a time-of-check/time-of-use (TOCTOU) race condition when mounting a cache volume at container build time (Snyk Blog, NVD).

The vulnerability occurs due to a race condition in the RUN --mount=type=cache directive in a Dockerfile, which allows for mounting persistent directories during Docker image build. When specifying a source path inside the identified cache mount, the validation of this source path introduces a race condition. A concurrent build step with the target cache directory mounted can replace the source path with a symbolic link between the check and use, causing the mount syscall to incorrectly mount an arbitrary directory into the container filesystem (Snyk Blog).

If successfully exploited, this vulnerability allows an attacker to gain unauthorized access to the underlying host operating system from within the container. The executing process inside the container can observe that the intended cache filesystem mount path contains a bind mount of the host root filesystem. With default access privileges typically set to root user, attackers can escalate from disk access to achieve full host root command execution (Snyk Blog, Hacker News).

The vulnerability has been patched in BuildKit version v0.12.5. Users should update to this version or later. For those unable to update immediately, workarounds include avoiding the use of BuildKit frontend from untrusted sources and not building untrusted Dockerfiles containing cache mounts with --mount=type=cache,source=... options (GitHub Advisory, BuildKit Release).

Major cloud providers including AWS, Google Cloud, and Ubuntu have released alerts urging customers to take appropriate action. Docker has acknowledged that the vulnerability can only be exploited if a user actively engages with malicious content by incorporating it into the build process or running a container from a rogue image (Hacker News).