Описание
An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity.
A flaw was found in BuildKit. An unauthenticated remote attacker controlling a container registry or Open Container Initiative (OCI) blob source can provide data that does not match its claimed cryptographic digest. Because BuildKit caches the resulting snapshot under the claimed digest, subsequent container builds may reuse the manipulated content, compromising build integrity.
Отчет
A flaw was found in BuildKit's snapshot caching mechanism when pulling container blobs from remote registries or OCI-layout sources. BuildKit fails to verify that downloaded blob data matches its advertised cryptographic digest before creating and caching the snapshot. A remote attacker controlling a registry or blob source can supply manipulated contents under a valid digest, causing BuildKit to cache poisoned layers. Subsequent builds referencing that digest reuse the tampered layer, compromising build artifact integrity.
Меры по смягчению последствий
Configure BuildKit to pull images and blobs exclusively from trusted, authenticated registries. Avoid sharing build daemon cache instances across untrusted workloads and regularly prune cached snapshots.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | buildah | Not affected | ||
| Red Hat Hardened Images | podman | Not affected | ||
| Red Hat Hardened Images | trivy | Not affected | ||
| Red Hat Quay 3 | quay/quay-builder-rhel8 | Fix deferred | ||
| Red Hat Quay 3 | quay/quay-builder-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity.
An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity.
An unauthenticated attacker controlling a registry or OCI-layout blob ...
6.5 Medium
CVSS3