REDHAT-BUG-2317458: High severity buildah vulnerability
Cache mounts (--mount type=cache,id=...) in Buildah and podman build do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Containerfile to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah. This codepath automatically performs an SELinux relabel on the directory in question to ensure the build has access to it, so SELinux does not stop this.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2317458?
The severity of REDHAT-BUG-2317458 is classified as critical.
How do I fix REDHAT-BUG-2317458?
To fix REDHAT-BUG-2317458, update to the latest version of Buildah or Podman where the vulnerability has been addressed.
What systems are affected by REDHAT-BUG-2317458?
REDHAT-BUG-2317458 affects Red Hat Buildah and Red Hat Podman.
Can REDHAT-BUG-2317458 lead to data exposure?
Yes, REDHAT-BUG-2317458 can potentially allow unauthorized access to arbitrary directories on the host.
What should I monitor for regarding REDHAT-BUG-2317458?
Monitor your container builds and ensure that the cache paths used are properly validated to mitigate potential risks from REDHAT-BUG-2317458.