Описание
A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.
A flaw was found in BuildKit. An attacker using a malicious external build frontend can trigger a Denial of Service (DoS) by sending requests through the internal API. This request sequence induces a data race condition, causing the BuildKit daemon to crash unexpectedly and interrupt build processes.
Отчет
A denial of service flaw was found in BuildKit's internal API request handling. An attacker utilizing a malicious external build frontend can transmit a specific sequence of requests via the internal API to induce a data race condition within the daemon. This concurrency race triggers an unhandled Go runtime panic, causing the buildkitd daemon process to crash abruptly and terminating all active and concurrent build operations running on the shared builder instance.
Меры по смягчению последствий
Restrict builds to trusted internal frontends by avoiding untrusted #syntax image directives or custom --frontend flags. Isolate multi-tenant build environments onto dedicated, single-tenant worker nodes to prevent shared daemon disruption.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | buildah | Not affected | ||
| Red Hat Hardened Images | podman | Not affected | ||
| Red Hat Hardened Images | trivy | Not affected | ||
| Red Hat Quay 3 | quay/quay-builder-rhel8 | Fix deferred | ||
| Red Hat Quay 3 | quay/quay-builder-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
4.7 Medium
CVSS3
Связанные уязвимости
A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.
A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.
A malicious external BuildKit frontend can send requests using the int ...
EPSS
4.7 Medium
CVSS3