CVE-2024-23652

A vulnerability was found in the Moby Builder Toolkit, which arose from BuildKit’s attempts to clean up temporarily added directories after use. A malicious BuildKit frontend or Dockerfile using RUN --mount could deceive the feature responsible for removing empty files created for the mount points, potentially leading to removing a file outside the container and affecting the host system. Successful exploitation of this issue may result in the arbitrary deletion of files and directories on the underlying host OS when building an image using a malicious Dockerfile or upstream image (for example, when using FROM).

Mitigation

Do not use BuildKit frontends or Dockerfiles from untrusted sources.