Описание
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents.
If a BuildKit daemon with shared or persistent cache first processes such a malicious image, a later build using the victim image may mount the attacker-controlled layer contents as the base image. This can allow code from the malicious image to run in the victim build, for example by replacing a commonly executed path such as /bin/sh. The attacker-controlled code may read build secrets mounted into the build, access other build resources, alter output artifacts, or hang the build.
The issue affects both regular snapshotters and lazy-pulling snapshotters such as stargz.
A flaw was found in BuildKit. A remote attacker can supply a crafted container image that advertises layer identifiers matching another image without containing the actual layer contents. Because BuildKit does not validate that these identifiers match the layer data before caching them, a shared build daemon can store the attacker's layers under the identity of a legitimate image. As a result, subsequent builds using the legitimate image may execute arbitrary attacker-controlled code, allowing the attacker to steal build secrets or tamper with build artifacts.
Отчет
A flaw was found in BuildKit's snapshot and cache identity derivation mechanism. When processing a container image, BuildKit fails to validate advertised DiffIDs against actual uncompressed layer contents. A remote attacker can provide a crafted image with spoofed DiffIDs to poison a shared daemon cache. Subsequent builds referencing legitimate base images can inadvertently mount attacker-controlled layers, leading to arbitrary code execution during the build lifecycle, compromise of mounted secrets, and manipulation of output artifacts.
Меры по смягчению последствий
Avoid sharing persistent BuildKit daemon cache instances across multi-tenant or untrusted build workloads, and isolate builder runners per tenant. Regularly prune daemon cache and restrict image pull access to verified, trusted registries.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | buildah | Not affected | ||
| Red Hat Hardened Images | podman | Not affected | ||
| Red Hat Hardened Images | trivy | Not affected | ||
| Red Hat Quay 3 | quay/quay-builder-rhel8 | Not affected | ||
| Red Hat Quay 3 | quay/quay-builder-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with shared or persistent cache first processes such a malicious image, a later build using the victim image may mount the attacker-controlled layer contents as the base image. This can allow code from the malicious image to run in the victim build, for example by replacing a commonly executed path such as /bin/sh. The attacker-controlled code may read build secrets mounted into the build, access other build resources, alter output artifacts, or hang the build. The issue affects both regular snapshotters and lazy-pulling snapshotters such as stargz.
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with shared or persistent cache first processes such a malicious image, a later build using the victim image may mount the attacker-controlled layer contents as the base image. This can allow code from the malicious image to run in the victim build, for example by replacing a commonly executed path such as /bin/sh. The attacker-controlled code may read build secrets mounted into the build, access other build resources, alter output artifacts, or hang the build. The issue affects both regular snapshotters and lazy-pulling snapshotters such as stargz.
A malicious image can advertise DiffIDs from another image while conta ...
EPSS
7.5 High
CVSS3