UBUNTU-CVE-2024-23652

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2024-23652

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-23652.json

JSON Data

https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2024-23652

Related

CVE-2024-23652

Published

2024-01-31T22:15:00Z

Modified

2025-02-14T16:32:07Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

[none]

Details

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.

References

Affected packages

Ubuntu:Pro:16.04:LTS / docker.io

Package

Name: docker.io
Purl: pkg:deb/ubuntu/docker.io@18.09.7-0ubuntu1~16.04.9+esm1?arch=source&distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.6.2~dfsg1-1ubuntu4

1.10.2-0ubuntu3

1.10.2-0ubuntu4

1.10.3-0ubuntu1

1.10.3-0ubuntu4

1.10.3-0ubuntu5

1.10.3-0ubuntu6

1.11.2-0ubuntu5~16.04

1.12.1-0ubuntu13~16.04.1

1.12.3-0ubuntu4~16.04.2

1.12.6-0ubuntu1~16.04.1

1.13.1-0ubuntu1~16.04.2

17.*

17.03.2-0ubuntu2~16.04.1

18.*

18.06.1-0ubuntu1~16.04.2

18.06.1-0ubuntu1.2~16.04.1

18.09.2-0ubuntu1~16.04.1

18.09.5-0ubuntu1~16.04.2

18.09.7-0ubuntu1~16.04.1

18.09.7-0ubuntu1~16.04.4

18.09.7-0ubuntu1~16.04.5

18.09.7-0ubuntu1~16.04.6

18.09.7-0ubuntu1~16.04.7

18.09.7-0ubuntu1~16.04.9+esm1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / docker.io

Package

Name: docker.io
Purl: pkg:deb/ubuntu/docker.io@20.10.21-0ubuntu1~18.04.3+esm1?arch=source&distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.13.1-0ubuntu6

17.*

17.03.2-0ubuntu1

17.03.2-0ubuntu3

17.03.2-0ubuntu5

17.12.1-0ubuntu1

18.*

18.06.1-0ubuntu1~18.04.1

18.06.1-0ubuntu1.2~18.04.1

18.09.2-0ubuntu1~18.04.1

18.09.5-0ubuntu1~18.04.2

18.09.7-0ubuntu1~18.04.1

18.09.7-0ubuntu1~18.04.3

18.09.7-0ubuntu1~18.04.4

19.*

19.03.6-0ubuntu1~18.04.1

19.03.6-0ubuntu1~18.04.2

19.03.6-0ubuntu1~18.04.3

20.*

20.10.2-0ubuntu1~18.04.2

20.10.2-0ubuntu1~18.04.3

20.10.7-0ubuntu1~18.04.1

20.10.7-0ubuntu1~18.04.2

20.10.7-0ubuntu5~18.04.2

20.10.7-0ubuntu5~18.04.3

20.10.12-0ubuntu2~18.04.1

20.10.21-0ubuntu1~18.04.2

20.10.21-0ubuntu1~18.04.3

20.10.21-0ubuntu1~18.04.3+esm1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / docker.io

Package

Name: docker.io
Purl: pkg:deb/ubuntu/docker.io@20.10.21-0ubuntu1~20.04.6?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

19.*

19.03.2-0ubuntu1

19.03.6-0ubuntu1

19.03.8-0ubuntu1

19.03.8-0ubuntu1.20.04

19.03.8-0ubuntu1.20.04.1

19.03.8-0ubuntu1.20.04.2

20.*

20.10.2-0ubuntu1~20.04.2

20.10.2-0ubuntu1~20.04.3

20.10.7-0ubuntu1~20.04.1

20.10.7-0ubuntu1~20.04.2

20.10.7-0ubuntu5~20.04.1

20.10.7-0ubuntu5~20.04.2

20.10.12-0ubuntu2~20.04.1

20.10.21-0ubuntu1~20.04.1

20.10.21-0ubuntu1~20.04.2

20.10.21-0ubuntu1~20.04.4

20.10.21-0ubuntu1~20.04.5

20.10.21-0ubuntu1~20.04.6

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / docker.io-app

Package

Name: docker.io-app
Purl: pkg:deb/ubuntu/docker.io-app@26.1.3-0ubuntu1~20.04.1?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

20.*

20.10.25-0ubuntu1~20.04.1

20.10.25-0ubuntu1~20.04.2

24.*

24.0.5-0ubuntu1~20.04.1

24.0.7-0ubuntu2~20.04.1

26.*

26.1.3-0ubuntu1~20.04.1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / docker.io

Package

Name: docker.io
Purl: pkg:deb/ubuntu/docker.io@20.10.21-0ubuntu1~22.04.7?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

20.*

20.10.7-0ubuntu5

20.10.7-0ubuntu7

20.10.12-0ubuntu1

20.10.12-0ubuntu2

20.10.12-0ubuntu3

20.10.12-0ubuntu3+gke1.24.1

20.10.12-0ubuntu4

20.10.21-0ubuntu1~22.04.2

20.10.21-0ubuntu1~22.04.3

20.10.21-0ubuntu1~22.04.5

20.10.21-0ubuntu1~22.04.6

20.10.21-0ubuntu1~22.04.7

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / docker.io-app

Package

Name: docker.io-app
Purl: pkg:deb/ubuntu/docker.io-app@26.1.3-0ubuntu1~22.04.1?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

20.*

20.10.25-0ubuntu1~22.04.1

20.10.25-0ubuntu1~22.04.2

24.*

24.0.5-0ubuntu1~22.04.1

24.0.7-0ubuntu2~22.04.1

26.*

26.1.3-0ubuntu1~22.04.1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.10 / docker.io

Package

Name: docker.io
Purl: pkg:deb/ubuntu/docker.io@26.1.4+dfsg2-1ubuntu1?arch=source&distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

20.*

20.10.25+dfsg1-2ubuntu1

20.10.25+dfsg1-3ubuntu1

26.*

26.1.4+dfsg2-1ubuntu1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.10 / docker.io-app

Package

Name: docker.io-app
Purl: pkg:deb/ubuntu/docker.io-app@26.1.3-0ubuntu1.1?arch=source&distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

24.*

24.0.7-0ubuntu4

26.*

26.1.3-0ubuntu1

26.1.3-0ubuntu1.1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / docker.io

Package

Name: docker.io
Purl: pkg:deb/ubuntu/docker.io@20.10.25+dfsg1-2ubuntu1?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

20.*

20.10.24+dfsg1-1ubuntu2

20.10.25+dfsg1-2ubuntu1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / docker.io-app

Package

Name: docker.io-app
Purl: pkg:deb/ubuntu/docker.io-app@26.1.3-0ubuntu1~24.04.1?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

24.*

24.0.5-0ubuntu1

24.0.7-0ubuntu1

24.0.7-0ubuntu2

24.0.7-0ubuntu3

24.0.7-0ubuntu4

24.0.7-0ubuntu4.1

26.*

26.1.3-0ubuntu1~24.04.1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}