CVE-2024-11218: Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile
Impact With careful use of the --mount flag in RUN instructions in Containerfiles, and by using either multi-stage builds with use of concurrently-executing build stages (e.g., using the --jobs CLI flag) or multiple separate but concurrently-executing builds, a malicious Containerfile can be used to expose content from the build host to the command being run using the RUN instruction. This can be used to read or write contents using the privileges of the process which is performing the build. When that process is a root-owned podman system service which is provided for use by unprivileged users, this includes the ability to read and write contents which the client should not be allowed to read and write, including setuid executables in locations where they can be later accessed by unprivileged users.
Patches Patches have been merged to the main branch, and will be added to upcoming releases on the release-1.38, release-1.37, release-1.35, and release-1.33 branches.
This addressed a number of Jira cards, but primarily https://issues.redhat.com/browse/RHEL-67616 and https://issues.redhat.com/browse/RHEL-67618, which were then vendored into Podman and backported into olde rbranches.
Workarounds Mandatory access controls should limit the access of the process performing the build, on systems where they are enabled.
Other sources
A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.
— NVD
A vulnerability was found in podman build and buildah. Container breakout by using --jobs=2 and race condition when building a malicious Containerfile. It might be mitigated by SELinux, but even with SELinux on it still allows enumeration of files and directories on the host.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/containers/buildahto a version that resolves this vulnerability.Fixed in 1.33.12 - Upgrade
Upgrade
go/github.com/containers/buildahto a version that resolves this vulnerability.Fixed in 1.35.5 - Upgrade
Upgrade
go/github.com/containers/buildahto a version that resolves this vulnerability.Fixed in 1.37.6 - Upgrade
Upgrade
go/github.com/containers/buildahto a version that resolves this vulnerability.Fixed in 1.38.1 - Compensating control
Ensure Mandatory Access Controls limit the access of the process performing the container build (e.g., rely on SELinux confinement and other MAC controls on systems where they are enabled).
- Compensating control
Avoid using --jobs=2 (and otherwise concurrently executing build stages/builds), since the container breakout relies on a race condition with --jobs=2 when building a malicious Containerfile.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11218?
CVE-2024-11218 is a vulnerability that has moderate severity due to its potential impact on container build processes.
How do I fix CVE-2024-11218?
To resolve CVE-2024-11218, upgrade to Buildah versions 1.33.12, 1.35.5, 1.37.6, or 1.38.1.
What is CVE-2024-11218?
CVE-2024-11218 involves a vulnerability in the handling of the `--mount` flag in Containerfiles that affects security during multi-stage builds.
Which software is affected by CVE-2024-11218?
CVE-2024-11218 affects specific versions of Buildah from the GitHub containers repository.
What type of attack does CVE-2024-11218 enable?
CVE-2024-11218 could enable a malicious container to exploit vulnerabilities in concurrent builds, which could compromise the integrity of the build process.