Описание
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with #syntax or --build-arg BUILDKIT_SYNTAX. Using these options with a well-known frontend image like docker/dockerfile is not affected.
A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. An untrusted BuildKit frontend can be leveraged to craft a malicious API message, allowing files to be written outside of the designated BuildKit state directory. This vulnerability, which is a form of arbitrary file write, could enable an attacker to execute unauthorized code or escalate their privileges on the system. This issue arises when custom BuildKit frontends are used with specific configuration options.
Отчет
An arbitrary file write vulnerability with moderate impact was found in BuildKit, a toolkit for converting source code into build artifacts that is used by a wide range of Red Hat products and container images. When a build explicitly selects an untrusted custom BuildKit frontend, set through the #syntax Dockerfile directive or the --build-arg BUILDKIT_SYNTAX option, that frontend can craft a malicious API message that causes files to be written outside of the BuildKit state directory for the execution context. This could allow an attacker to execute unauthorized code or escalate their privileges on the system. Builds that use well-known, trusted frontend images such as docker/dockerfile are not affected. Red Hat rates this flaw as having moderate impact because exploitation requires local access, privileges, and user interaction to explicitly configure an untrusted frontend (Red Hat CVSS:3.1 score 8.2, vector AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H); this differs meaningfully from the NIST rating of critical (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A fix is being pursued for the affected Red Hat products.
Меры по смягчению последствий
To mitigate this vulnerability, avoid using untrusted BuildKit frontends. Restrict the use of custom BuildKit frontends to only those from verified and trusted sources. Do not specify untrusted frontends via #syntax or --build-arg BUILDKIT_SYNTAX.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | assisted/agent-preinstall-image-builder-rhel9 | Affected | ||
| Confidential Compute Attestation | openshift-sandboxed-containers/osc-must-gather-rhel9 | Will not fix | ||
| Kernel Module Management Operator for Red Hat Openshift | kmm/kernel-module-management-must-gather-rhel9 | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/cluster-logging-rhel9-operator | Will not fix | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/cluster-logging-rhel9-operator | Not affected | ||
| Logical Volume Manager Storage | lvms4/lvms-must-gather-rhel9 | Not affected | ||
| Migration Toolkit for Applications 8 | mta/mta-cli-rhel9 | Not affected | ||
| Migration Toolkit for Applications 8 | mta/mta-discovery-addon-rhel9 | Not affected | ||
| Migration Toolkit for Containers | rhmtc/openshift-migration-log-reader-rhel8 | Affected | ||
| Migration Toolkit for Containers | rhmtc/openshift-migration-must-gather-rhel8 | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.2 High
CVSS3
Связанные уязвимости
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.
BuildKit is a toolkit for converting source code to build artifacts in ...
EPSS
8.2 High
CVSS3