GHSA-2fqp-xg6f-v7gj: Possible panic from Git source resolver
In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BuildKitto a version that resolves this vulnerability.Fixed in v0.34.2
Event History
Frequently Asked Questions
Which BuildKit deployments are affected?
BuildKit versions v0.26.0 through v0.34.1 are affected. The issue is fixed in v0.34.2.
What must an attacker provide to trigger the crash?
A build definition must resolve metadata for the same Git source reference twice. Exploitation requires user interaction, as reflected by the UI:A vector.
What is the operational impact of successful exploitation?
The BuildKit daemon can panic and crash. Builds being handled by that daemon are interrupted.
What should teams do if they are running an affected version?
Upgrade BuildKit to v0.34.2. The provided information does not describe an alternative mitigation for systems that cannot be patched immediately.