Improper Validation of Integrity Check Value Affecting github.com/moby/buildkit/client package, versions <0.33.1

Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via unvalidated image layer DiffIDs through the setBlob and snapshot identity handling in cache/blobs.go, cache/metadata.go, and cache/refs.go. An attacker can cause a later build to mount attacker-controlled layer contents as the base image by supplying a malicious image whose advertised DiffIDs match a victim image while the actual layer data differs. When a shared or persistent BuildKit cache processes that image first, subsequent builds may reuse the poisoned cache entry and execute code from the malicious layer, such as replacing a common path like /bin/sh. This can leak build secrets, alter build outputs, or hang the build, breaking the integrity and reliability of affected builds.

Workarounds

• Do not share a BuildKit daemon cache between trusted and untrusted builds; use isolated BuildKit daemons or ephemeral builders for untrusted image sources so a malicious image cannot poison a later trusted build’s shared cache.
• Prune BuildKit cache after processing untrusted images to remove any attacker-influenced cache entries before the daemon handles trusted builds.

• GitHub Commit v0.32.2
• GitHub Commit v0.33.1
• GitHub Commit v0.33.1
• GitHub Commit v0.33.1
• Maintainer's Advisory