Listen to this Post
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.31.1, BuildKit read attacker-controlled `/etc/passwd` and `/etc/group` files without an upper bound while resolving a username to a user identifier or group identifier in `executor/oci/user.go` and solver/llbsolver/ops/user_linux.go. This vulnerability, identified as CVE-2026-61712, allows a maliciously crafted base image or build context to cause a Denial of Service (DoS) condition.
The core issue lies in the absence of size limits when BuildKit parses user and group database files during image builds. When a build process references a username or group name (e.g., in `USER` or `RUN –user` directives), BuildKit resolves these identifiers by reading the corresponding entries from `/etc/passwd` and `/etc/group` files within the build context. An attacker can craft a base image or build context containing an excessively large `/etc/passwd` or `/etc/group` file—potentially gigabytes in size—with millions of entries. During user resolution, BuildKit loads the entire file into memory without any validation or size restriction.
This unbounded memory allocation quickly exhausts the available memory on the host system running the `buildkitd` daemon. The Linux kernel’s Out-Of-Memory (OOM) killer then terminates the `buildkitd` process to prevent system-wide instability. This results in a complete denial of service for all ongoing and subsequent build operations until the daemon is manually restarted. The attack requires minimal effort—simply pulling and using a maliciously crafted image or providing a malicious build context with an oversized user/group database. The vulnerability is classified as low severity with a CVSS v4.0 score of 2.3, as it primarily affects availability without compromising confidentiality or integrity.
The fix, implemented in BuildKit v0.31.1, introduces a constant `maxUserFileBytes = 10 << 20` (10 MiB) limit and validates that the file is a regular file before reading. The patch also applies this bounded reading to the LLB solver operations in user_linux.go. This is the BuildKit variant of the containerd advisory GHSA-jpcc-p29g-p8mq (CVE-2026-47262), which describes a similar exploitation path through processing untrusted container image content.
DailyCVE Form:
Platform: BuildKit (moby/buildkit)
Version: < 0.31.1
Vulnerability: Unbounded Resource Allocation
Severity: Low (CVSS 2.3)
Date: 2026-08-19
Prediction: 2026-06-24 (already patched)
What Undercode Say:
Analytics:
- CVE-2026-61712 affects all BuildKit versions prior to 0.31.1
- Published to GitHub Advisory Database on 2026-08-19
- Related to containerd CVE-2026-47262 / GHSA-jpcc-p29g-p8mq
- Attack Vector: Network, Attack Complexity: Low, Privileges Required: None
- CWE-770: Allocation of Resources Without Limits or Throttling
Check BuildKit version:
buildkitd --version
Check for vulnerable files in a suspicious image:
docker run --rm <image> wc -c /etc/passwd /etc/group
Monitor buildkitd memory usage:
ps aux | grep buildkitd watch -n 1 'ps -o vsz,rss,cmd -C buildkitd'
Exploit: (Educational Purposes!)
A malicious base image can be crafted with an oversized `/etc/passwd` file:
Malicious Dockerfile FROM scratch RUN dd if=/dev/zero of=/etc/passwd bs=1M count=1024
Build and push the malicious image:
docker build -t malicious:latest . docker push malicious:latest
Trigger the DoS by using the malicious image in a build:
buildctl build --frontend=dockerfile.v0 --local context=. --opt build-arg:BASE=malicious:latest
The `buildkitd` process will consume all available memory and be OOM-killed.
Protection:
- Upgrade BuildKit to version 0.31.1 or higher immediately
- Use only trusted build sources and base images
- Configure cgroup-level memory limits on build nodes to prevent host system crashes
- Run the `buildkitd` daemon in rootless mode to restrict container escape vectors
- Restart the daemon after upgrade: `systemctl restart buildkit`
Impact:
- Denial of Service through memory exhaustion and OOM kill of `buildkitd`
– All build operations become unavailable until daemon restart - Potential cascading failures in CI/CD pipelines relying on BuildKit
- No confidentiality or integrity impact—only availability is affected
- Exploitation requires no special privileges—only the ability to provide a malicious build context or pull a malicious image
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
