Vulnerable packages - Containerd, Opencontainers/run, moby/buildkit

[raghu017]

Description

When these vulnerabilities will be resolved?

opencontainers/runc - CVE-2023-25809
moby/buildkit - CVE-2023-26054
Containerd - CVE-2023-25173

[jedevc]

Looks like a dupe of #1725 that you closed?

To answer the question:

• Buildx definitely isn't affected by the runc vulnerability, buildx does not directly create containers using runc, this is left to https://github.com/moby/buildkit. See [v0.11 backport] Dockerfile: RUNC_VERSION=v1.1.5 moby/buildkit#3763 for the progress on merging and resolving this - this should make it into the next patch release of BuildKit v0.11.
• Buildx + Buildkit share a large number of their maintainers - so the resolution for the BuildKit CVE is already done. The issue is server-side, and since buildx is a client, we are not directly vulnerable. However, we have applied some local mitigations in https://github.com/docker/buildx/releases/tag/v0.10.4.
• For containerd, like runc, this is a Buildkit server-side issue, see Ensures that the primary GID is also included in the additional GIDs moby/buildkit#3651 for more information.

If you use the latest version of Buildx and Buildkit, you should not be vulnerable to any of the above CVEs. The reason these will appear in CVE scanners is because we use these packages by dependency on the client side, even if the vulnerable issue is only part of the BuildKit server.

At some point in the future, the vendored dependencies will be updated in buildx as well.

[y4ney]

The 0.11.0 version of buildx still uses the v0.11.0-rc3.0.20230609092854-67a08623b95a version of buildkit, so the trivy scanner is still used to scan the CVE-2023-26054 . could you please upgrade the buildkit version to 0.11.4 to fix this vulnerability?

 {
          "VulnerabilityID": "CVE-2023-26054",
          "PkgName": "github.com/moby/buildkit",
          "InstalledVersion": "v0.11.0-rc3.0.20230609092854-67a08623b95a",
          "FixedVersion": "0.11.4",
          "Layer": {
            "DiffID": "sha256:a8ab95fd1b4bdaaaa2a154c764f7ad8f9f269a9824c8dd5f36b1606162734bb5"
          },
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-26054",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Go",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago"
          },
          "Title": "Data disclosure in provenance attestation describing a build",
          "Description": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation. Git URL can be passed in two ways: 1) Invoking build directly from a URL with credentials. 2) If the client sends additional version control system (VCS) info hint parameters on builds from a local source. Usually, that would mean reading the origin URL from `.git/config` file. When a build is performed under specific conditions where credentials were passed to BuildKit they may be visible to everyone who has access to provenance attestation. Provenance attestations and VCS info hints were added in version v0.11.0. Previous versions are not vulnerable. In v0.10, when building directly from Git URL, the same URL could be visible in `BuildInfo` structure that is a predecessor of Provenance attestations. Previous versions are not vulnerable. This bug has been fixed in v0.11.4. Users are advised to upgrade. Users unable to upgrade may disable VCS info hints by setting `BUILDX_GIT_INFO=0`. `buildctl` does not set VCS hints based on `.git` directory, and values would need to be passed manually with `--opt`.",
          "Severity": "MEDIUM",
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "V3Score": 6.5
            },
            "nvd": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "V3Score": 6.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "V3Score": 6.5
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2023-26054",
            "https://github.com/advisories/GHSA-gc89-7gcr-jxqc",
            "https://github.com/moby/buildkit/commit/75123c696506bdbca1ed69906479e200f1b62604",
            "https://github.com/moby/buildkit/security/advisories/GHSA-gc89-7gcr-jxqc",
            "https://nvd.nist.gov/vuln/detail/CVE-2023-26054",
            "https://www.cve.org/CVERecord?id=CVE-2023-26054",
            "https://www.rfc-editor.org/rfc/rfc3986#section-3.2.1"
          ],
          "PublishedDate": "2023-03-06T19:15:00Z",
          "LastModifiedDate": "2023-03-13T18:37:00Z"
        }

[jedevc]

This is a scanner false positive. Buildx's go.mod is not reporting the version correctly because of go pseudoversions.

We are vendoring directly off of buildkit master, which includes the fix for GHSA-gc89-7gcr-jxqc, which was then cherry-picked to the v0.11 release branch for buildkit.