Описание
A malicious frontend can submit an LLB definition that causes buildkitd
to panic and terminate, interrupting all builds running on that daemon.
A flaw was found in BuildKit. A malicious build frontend can submit a crafted low-level builder (LLB) definition that triggers an unexpected panic in the BuildKit daemon. This issue leads to a Denial of Service (DoS), causing the daemon process to crash and interrupting all active builds running on the host.
Отчет
A denial of service flaw was found in BuildKit's low-level builder (LLB) definition processing subsystem. The buildkitd daemon fails to properly validate input parameters and array indices within submitted LLB definitions. A malicious build frontend can supply a crafted LLB definition referencing invalid elements or operations, triggering an unhandled Go runtime panic. This panic abruptly terminates the buildkitd daemon process, crashing all concurrent and active build operations running on the shared host or container instance.
Меры по смягчению последствий
Avoid using custom or untrusted BuildKit frontends, and restrict build submission access to verified users. Isolate build daemon instances per tenant to prevent cross-tenant build interruption.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | buildah | Not affected | ||
| Red Hat Hardened Images | podman | Not affected | ||
| Red Hat Hardened Images | trivy | Not affected | ||
| Red Hat Quay 3 | quay/quay-builder-rhel8 | Fix deferred | ||
| Red Hat Quay 3 | quay/quay-builder-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.2 Medium
CVSS3
Связанные уязвимости
A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.
A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.
A malicious frontend can submit an LLB definition that causes buildkit ...
EPSS
6.2 Medium
CVSS3