Описание
When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.
A flaw was found in BuildKit. When proxy networking with Certificate Authority (CA) injection is enabled, a build can modify its CA certificate bundle before cleanup operations execute. A local user running a build can exploit this issue to cause the cleanup process to hang, resulting in a Denial of Service (DoS), or trigger file modifications outside the build's intended root filesystem (rootfs).
Отчет
A race condition flaw was found in BuildKit when proxy networking with Certificate Authority (CA) injection is enabled. BuildKit does not ensure atomicity between validating and cleaning up injected CA bundles. A local user executing a build can manipulate the CA bundle path or replace it with a symlink before cleanup runs. When the buildkitd daemon executes post-build cleanup, operations can hang indefinitely—causing a denial of service—or traverse outside the container rootfs, resulting in unauthorized file modification or deletion on the underlying host.
Меры по смягчению последствий
Disable proxy networking with CA injection in BuildKit daemon configurations. Alternatively, isolate builds into ephemeral, single-tenant container runners and restrict build submission access to trusted users.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | buildah | Not affected | ||
| Red Hat Hardened Images | podman | Not affected | ||
| Red Hat Hardened Images | trivy | Not affected | ||
| Red Hat Quay 3 | quay/quay-builder-rhel8 | Fix deferred | ||
| Red Hat Quay 3 | quay/quay-builder-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.4 Medium
CVSS3
Связанные уязвимости
When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.
When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.
When proxy networking with CA injection is enabled, a build can modify ...
EPSS
6.4 Medium
CVSS3