Описание
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.
A flaw was found in BuildKit. This vulnerability allows an attacker to trick the build engine into performing file operations on special file inodes where regular files are expected. By providing a crafted build context, an attacker can block build operations leading to a Denial of Service (DoS) or, on rootful workers, gain unintended access to underlying host devices.
Отчет
A flaw was found in BuildKit's file handling subsystem during build context extraction and layer processing. BuildKit fails to restrict operations to regular files, incorrectly interacting with special file inodes such as character or block devices and FIFOs. An attacker supplying a crafted build context or Dockerfile can cause blocking I/O calls to trigger a denial of service. Furthermore, on rootful worker nodes lacking user namespace isolation, an attacker can manipulate device nodes to gain unauthorized read and write access to underlying host devices.
Меры по смягчению последствий
Execute BuildKit workers in rootless mode with user namespaces enabled to prevent unauthorized host device interaction. Pre-filter and sanitize build contexts in CI/CD pipelines to reject non-regular file inodes prior to invoking the build engine.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | buildah | Not affected | ||
| Red Hat Hardened Images | podman | Not affected | ||
| Red Hat Hardened Images | trivy | Not affected | ||
| Red Hat Quay 3 | quay/quay-builder-rhel8 | Not affected | ||
| Red Hat Quay 3 | quay/quay-builder-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.2 High
CVSS3
Связанные уязвимости
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.
BuildKit may be tricked into performing file actions with special file ...
EPSS
8.2 High
CVSS3