GHSA-72x6-4j93-7w86: Go/github.com/moby/buildkit vulnerability
Impact Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the buildkitd process.
Patches Issue is fixed in BuildKit v0.31.1+
Workarounds Use trusted build sources.
References This is BuildKit variant of containerd advisory https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/moby/buildkitto a version that resolves this vulnerability.Fixed in 0.31.1 - Upgrade
Upgrade
BuildKitto a version that resolves this vulnerability.Fixed in 0.31.1 - Compensating control
Use trusted build sources.
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service condition?
BuildKit environments that create containers from maliciously crafted base images or builds are exposed. Successful exploitation can exhaust memory and cause the buildkitd process to be killed by the operating system.
What does an attacker need to exploit this issue?
An attacker needs to cause BuildKit to process a maliciously crafted base image or build. The advisory does not describe any additional authentication, network, or local-access prerequisites.
What should teams do if they cannot upgrade immediately?
Use only trusted build sources and base images until BuildKit can be updated. The issue is fixed in BuildKit v0.31.1 and later.