high
8.6
CWE
269 362
Advisory Published
Advisory Published
CVE Published
Updated

CVE-2024-11218: Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile

First published: Thu Nov 14 2024(Updated: )

### Impact With careful use of the `--mount` flag in RUN instructions in Containerfiles, and by using either multi-stage builds with use of concurrently-executing build stages (e.g., using the `--jobs` CLI flag) or multiple separate but concurrently-executing builds, a malicious Containerfile can be used to expose content from the build host to the command being run using the RUN instruction. This can be used to read or write contents using the privileges of the process which is performing the build. When that process is a root-owned podman system service which is provided for use by unprivileged users, this includes the ability to read and write contents which the client should not be allowed to read and write, including setuid executables in locations where they can be later accessed by unprivileged users. ### Patches Patches have been merged to the main branch, and will be added to upcoming releases on the release-1.38, release-1.37, release-1.35, and release-1.33 branches. This addressed a number of Jira cards, but primarily https://issues.redhat.com/browse/RHEL-67616 and https://issues.redhat.com/browse/RHEL-67618, which were then vendored into Podman and backported into olde rbranches. ### Workarounds Mandatory access controls should limit the access of the process performing the build, on systems where they are enabled.

Credit: secalert@redhat.com secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
go/github.com/containers/buildah<1.33.12
1.33.12
go/github.com/containers/buildah>=1.35.0<1.35.5
1.35.5
go/github.com/containers/buildah>=1.37.0<1.37.6
1.37.6
go/github.com/containers/buildah>=1.38.0<1.38.1
1.38.1

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2024-11218?

    CVE-2024-11218 is a vulnerability that has moderate severity due to its potential impact on container build processes.

  • How do I fix CVE-2024-11218?

    To resolve CVE-2024-11218, upgrade to Buildah versions 1.33.12, 1.35.5, 1.37.6, or 1.38.1.

  • What is CVE-2024-11218?

    CVE-2024-11218 involves a vulnerability in the handling of the `--mount` flag in Containerfiles that affects security during multi-stage builds.

  • Which software is affected by CVE-2024-11218?

    CVE-2024-11218 affects specific versions of Buildah from the GitHub containers repository.

  • What type of attack does CVE-2024-11218 enable?

    CVE-2024-11218 could enable a malicious container to exploit vulnerabilities in concurrent builds, which could compromise the integrity of the build process.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203