VDB
Sign up
HIGH8.7

GHSA-m3r6-h7wv-7xxv

BuildKit vulnerable to possible race condition with accessing subpaths from cache mounts

Quick fix

GHSA-m3r6-h7wv-7xxv — github.com/moby/buildkit: upgrade to the fixed version with the command below.

go get github.com/moby/buildkit@v0.12.5

Details

### Impact Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container.

### Patches The issue has been fixed in v0.12.5

### Workarounds Avoid using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with `--mount=type=cache,source=...` options.

### References https://www.openwall.com/lists/oss-security/2019/05/28/1

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/moby/buildkit
Introduced in: 0Fixed in: 0.12.5
Fixgo get github.com/moby/buildkit@v0.12.5

References