BuildKit vulnerabilities
12 known vulnerabilities in BuildKit from Moby. 12 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
BuildKit: Improper Validation of Integrity Check Value
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer co
- 7.1 High severity
BuildKit: NULL Pointer Dereference
If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident.
- 7.2 High severity
buildkit: Improper Limitation of a Pathname to a Restricted Directory
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled
- 7.5 High severity
BuildKit: Improper Neutralization of Argument Delimiters in a Command
BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.
- 7.5 High severity
BuildKit: Improper Limitation of a Pathname to a Restricted Directory
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.
- 7.5 High severity
BuildKit: Improper Limitation of a Pathname to a Restricted Directory
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentica
- 7.5 High severity
BuildKit: Improper Link Resolution Before File Access
BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host fil
- 7.5 High severity
buildkit: Improper Limitation of a Pathname to a Restricted Directory
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git
- 9.8 Critical severity
buildkit: Improper Limitation of a Pathname to a Restricted Directory
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside
- 9.8 Critical severity
buildkit: Incorrect Authorization
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It wa
- 9.1 Critical severity
buildkit: Improper Limitation of a Pathname to a Restricted Directory
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints in
- 7.4 High severity
buildkit: Concurrent Execution using Shared Resource with Improper Synchronization
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files