GHSA-7236-3392-c5c6: Input Validation
Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers.
Patches Problem has been fixed in versions v0.31.1+
Workarounds Only use BuildKit frontends from trusted providers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/moby/buildkitto a version that resolves this vulnerability.Fixed in 0.31.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.31.1 - Compensating control
Only use BuildKit frontends from trusted providers.
Event History
Frequently Asked Questions
Who is exposed to this issue?
BuildKit users who run custom frontends are exposed, because a crafted build request from such a frontend can disable Seccomp and AppArmor protections for the build container. The issue applies even when the user did not explicitly allow the security.insecure entitlement.
What does an attacker need to exploit it?
An attacker needs the ability to provide or cause use of a crafted build request through a custom BuildKit frontend. The advisory does not indicate that standard trusted frontends are affected.
What protections remain in place if exploitation occurs?
Linux capabilities and other security measures continue to be applied to the affected build containers. Seccomp and AppArmor protections are the controls that can be disabled.
What can be done before patching?
Use only BuildKit frontends from trusted providers. The issue is fixed in BuildKit v0.31.1 and later.