GHSA-w26x-xg27-7qjc: Malicious client could set xattr value outside of BuildKit state directory
In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BuildKitto a version that resolves this vulnerability.Fixed in v0.34.1
Event History
Frequently Asked Questions
Who is most at risk from this issue?
Build services running BuildKit before v0.34.1 that accept build requests from untrusted users are affected. Exploitation requires a malicious client to have access to the BuildKit control APIs.
What does an attacker need to do to exploit it?
The attacker needs BuildKit control API access and the ability to submit a build request. They can use that request to set an extended attribute on a file outside the BuildKit state directory.
What is the potential host impact?
An attacker may be able to set extended attributes in the trusted. or security. namespaces. Those attributes could allow a program on the host to gain elevated privileges.
What should be done to remediate the issue?
Upgrade BuildKit to v0.34.1. If an immediate upgrade is not possible, do not allow untrusted users to submit build requests or access the BuildKit control APIs.