Impact
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.
Patches
The issue has been fixed in v0.31.2+
Workarounds
The issue only affects the low-level API and can not be reached when building Dockerfiles. Using a custom BuildKit frontend would be needed to make such a crafted request.
References
thesecguy45 Reporter
Impact
A crafted message in the BuildKit low-level build API can be used to remove the contents of the
/tmpdirectory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.Patches
The issue has been fixed in v0.31.2+
Workarounds
The issue only affects the low-level API and can not be reached when building Dockerfiles. Using a custom BuildKit frontend would be needed to make such a crafted request.
References