Описание
A malicious frontend can submit an LLB definition that causes buildkitd
to panic and terminate, interrupting all builds running on that daemon.
A flaw was found in BuildKit. This vulnerability can lead to a Denial of Service (DoS) when a malicious build frontend submits a specially crafted low-level builder (LLB) definition. Processing this definition causes the build daemon to panic and terminate unexpectedly, interrupting all active build operations running on the daemon.
Отчет
A denial of service flaw was found in BuildKit's low-level builder (LLB) graph processing subsystem. The daemon fails to validate array and slice indices derived from fields within an LLB definition submitted by a build frontend. When an attacker-controlled frontend passes a malformed LLB graph referencing out-of-bounds indices, an unhandled Go runtime panic occurs. This panic terminates the buildkitd daemon process, abruptly aborting all active and concurrent build operations sharing the daemon instance.
Меры по смягчению последствий
Restrict access to the BuildKit daemon API socket to trusted users and verified build frontends. Isolate multi-tenant build environments onto dedicated, single-tenant builder runners to prevent cross-tenant denial of service.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | buildah | Not affected | ||
| Red Hat Hardened Images | podman | Not affected | ||
| Red Hat Hardened Images | trivy | Not affected | ||
| Red Hat Quay 3 | quay/quay-builder-rhel8 | Fix deferred | ||
| Red Hat Quay 3 | quay/quay-builder-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.2 Medium
CVSS3
Связанные уязвимости
A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.
A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.
A malicious frontend can submit an LLB definition that causes buildkit ...
EPSS
6.2 Medium
CVSS3