BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.
CVSS Details
- CVSS 3.1 Base Score: 10
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade buildkitUpgrade podmanUpgrade dockerUpgrade singularity | Aug 22, 2024 | Jan 31, 2024 |
| Amazon Linux Ami 2 | — | Upgrade dockerUpgrade docker-debuginfo | Mar 6, 2024 | Jan 31, 2024 |
| Amazon_linux_2023 | — | Upgrade dockerUpgrade docker-debugsourceUpgrade docker-debuginfo | Feb 26, 2025 | Jan 31, 2024 |
| Dell Powerstore Dsa2024398 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 17, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Dell Powerstore Dsa2024432 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 29, 2024 |
| Gentoo Linux | — | Upgrade app-containers/podman.Upgrade app-containers/buildah.Upgrade app-containers/docker. | Jul 9, 2024 | Jan 31, 2024 |
| Suse | — | Upgrade docker-stable-rootless-extrasUpgrade docker-fish-completionUpgrade buildahUpgrade buildkitUpgrade dockerUpgrade docker-bash-completionUpgrade docker-stable-fish-completionUpgrade docker-buildxUpgrade docker-stable-bash-completionUpgrade docker-rootless-extrasUpgrade docker-zsh-completionUpgrade docker-stableUpgrade docker-stable-zsh-completion | Feb 23, 2024 | Jan 31, 2024 |
| Ubuntu | — | Upgrade docker.io (Ubuntu Pro)Upgrade golang-github-docker-docker-dev (Ubuntu Pro) | May 2, 2025 | Jan 31, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub