REDHAT-BUG-2452076: Medium severity Moby BuildKit vulnerability
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with #syntax or --build-arg BUILDKITSYNTAX. Using these options with a well-known frontend image like docker/dockerfile is not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
moby/buildkitto a version that resolves this vulnerability.Fixed in 0.28.1 - Configuration
If using BuildKit, avoid setting an untrusted custom frontend via `#syntax` or `--build-arg BUILDKIT_SYNTAX`; use a well-known frontend image such as `docker/dockerfile`, which is not affected.
BuildKit frontend selection Untrusted custom BuildKit frontend usage via #syntax or BUILDKIT_SYNTAX = Use a trusted/well-known frontend image only (e.g., docker/dockerfile)
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2452076?
The severity of REDHAT-BUG-2452076 is medium with a score of 4.
How do I fix REDHAT-BUG-2452076?
To fix REDHAT-BUG-2452076, upgrade to Moby BuildKit version 0.28.1 or later.
What kind of vulnerability is REDHAT-BUG-2452076?
REDHAT-BUG-2452076 is a vulnerability that allows a custom BuildKit frontend to write files outside of the designated state directory.
What software is affected by REDHAT-BUG-2452076?
The affected software in REDHAT-BUG-2452076 is Moby BuildKit.
What does BuildKit do in relation to REDHAT-BUG-2452076?
BuildKit is a toolkit that efficiently converts source code into build artifacts, and in this vulnerability, it relates to improper API message handling by custom frontends.