moby/buildkit Multiple Security Vulnerabilities Patch Advisory

Vulnerability Overview In version v0.33.1 of , several security vulnerabilities exist, primarily involving the Dockerfile frontend, build step redirection, CDI device support, container blob content verification, image layer snapshots, LLB file operations, special file handling, and source identifier matching. Affected Scope Dockerfile frontend: The built-in Dockerfile frontend has been updated to v1.27.1. Build step redirection: Fixed proxy CA cleanup issues to prevent build steps from redirecting outside the build root directory. CDI device support: Fixed daemon crashes when CDI support is disabled. Container blob content verification: Verifies that container blob contents match their declared digests to prevent unverified blobs from being cached via the low-level LLB API. Image layer snapshots: Verifies the DiffIDs of applied image layers, binds lazy stargz snapshots to their verified TOC digests, and isolates legacy layer snapshots. LLB file operations: Rejects malformed LLB file operations to prevent daemon crashes. Special file handling: Rejects special files during daemon-side snapshot reads and replaces existing special files in LLB operations. Source identifier matching: Applies source policies to Git bundle locators and rejects full Git remote URLs that do not match the source identifier. Remediation Dockerfile frontend: Update to v1.27.1. Build step redirection: Prevent redirection by treating special files or handling cleanup failures appropriately. CDI device support: Ignore optional devices and require device errors to be generated. Container blob content verification: Verify that container blob contents match their declared digests. Image layer snapshots: Verify the DiffIDs of applied image layers, bind lazy stargz snapshots to their verified TOC digests, and isolate legacy layer snapshots. LLB file operations: Reject malformed LLB file operations to prevent daemon crashes. Special file handling: Reject special files during daemon-side snapshot reads and replace existing special files in LLB operations. Source identifier matching: Apply source policies to Git bundle locators and reject full Git remote URLs that do not match the source identifier. POC Code or Exploit Code No specific POC code or exploit code was provided on the page.

Goal Reached Thanks to every supporter — we hit 100%!

moby/buildkit Multiple Security Vulnerabilities Patch Advisory

More from this source