VDB
Sign up
CRITICAL10.0

GHSA-4v98-7qmw-rqr8

BuildKit vulnerable to possible host system access from mount stub cleaner

Quick fix

GHSA-4v98-7qmw-rqr8 — github.com/moby/buildkit: upgrade to the fixed version with the command below.

go get github.com/moby/buildkit@v0.12.5

Details

### Impact A malicious BuildKit frontend or Dockerfile using `RUN --mount` could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system.

### Patches The issue has been fixed in v0.12.5

### Workarounds Avoid using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing `RUN --mount` feature.

### References

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/moby/buildkit
Introduced in: 0Fixed in: 0.12.5
Fixgo get github.com/moby/buildkit@v0.12.5

References