GHSA-7236-3392-c5c6
BuildKit: Custom frontend could bypass Seccomp/AppArmor
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/moby/buildkit | < 0.31.1 | 0.31.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the `security.insecure` entitlement. Other security measures, like Linux capabilities were still applied to these containers.
### Patches
Problem has been fixed in versions v0.31.1+
### Workarounds
Only use BuildKit frontends from trusted providers.
References
External links from the advisory. They lead to third-party sites.