CyberRota Analysis
AI-GeneratedA vulnerability in BuildKit prior to version 0.31.1 allows a custom frontend to inject an invalid SecurityMode value in a crafted build request, which causes the system to treat it as a non-sandbox mode, effectively bypassing Seccomp and AppArmor protections. This could lead to potential security risks during the build process, as it undermines the intended isolation and security measures. Organizations using affected versions of BuildKit should prioritize updating to version 0.31.1 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/spec_linux.go treated the unsupported value as a non-sandbox mode without requiring the security.insecure entitlement. This disabled Seccomp and AppArmor protections for the build container even though Linux capabilities remained restricted. This issue is fixed in version 0.31.1.