REDHAT-BUG-2315887
First published: Tue Oct 01 2024(Updated: )
A flaw in the bind-propagation option of the Dockerfile RUN --mount instruction allows arbitrary parameters to be passed to the underlying mount command. This issue enables an attacker to mount arbitrary host files into a container during the build process and potentially modify them. SELinux does not provide sufficient defense, as the attacker can specify :z or :Z to relabel the host directory for container access. The vulnerability requires an attacker to have build privileges on the system and can lead to unauthorized access and modification of host files, posing significant security risks.
| Affected Software | Affected Version | How to fix |
|---|
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-9407
- agent/severity
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/type
- agent/event
- agent/first-publish-date