Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 925022 (CVE-2024-23650, CVE-2024-24557) - app-containers/docker: multiple vulnerabilities
Summary: app-containers/docker: multiple vulnerabilities
Alias: CVE-2024-23650, CVE-2024-24557
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
Whiteboard: B3 [ebuild]
Depends on:
Blocks: CVE-2024-23651, CVE-2024-23652, CVE-2024-23653
  Show dependency tree
Reported: 2024-02-19 23:47 UTC by John Helmert III
Modified: 2024-02-19 23:47 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2024-02-19 23:47:02 UTC
CVE-2024-23650 (

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.

CVE-2024-24557 (

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

Please bump to 24.0.9 and/or 25.0.2.