VDB
Sign up
HIGH8.4

GHSA-4c29-8rgm-jvjj

BuildKit's Malicious frontend can cause file escape outside of storage root

Quick fix

GHSA-4c29-8rgm-jvjj — github.com/moby/buildkit: upgrade to the fixed version with the command below.

go get github.com/moby/buildkit@v0.28.1

Details

### Impact When using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context.

### Patches The issue has been fixed in v0.28.1+

### Workarounds Issue requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/moby/buildkit
Introduced in: 0Fixed in: 0.28.1
Fixgo get github.com/moby/buildkit@v0.28.1

References