BuildKit: unbounded /etc/passwd read from a build image OOM-kills the buildkitd daemon

Impact

buildkitd reads /etc/passwd and /etc/group from the build context with no size limit while resolving a USER directive, so a base image carrying an oversized passwd file exhausts memory and the daemon is OOM-killed. On a shared build host that takes every tenant's builds, one crafted base image kills the daemon for everyone and drops in-flight builds. It is availability-only - no code execution or data exposure is claimed - but a build fleet that also schedules image builds for GPU jobs stalls the job pipeline behind it.

Who can reach it

Anyone who can get BuildKit to build a Dockerfile referencing an attacker-supplied base image, or submit a build definition. The CVSS vector marks user interaction as required and no privileges, matching the case where an operator builds an untrusted image.

What to do

Upgrade BuildKit to 0.31.1 or later (commits 408266e and 69a3924) and restart buildkitd; queued builds must be resubmitted. Until then, restrict which registries and base images the builder will pull, and run buildkitd under a memory cgroup so an OOM kill takes only the builder rather than the host.

References