Vulnerability · Published Oct 9, 2024 · Assigned by redhat

CVE-2024-9675Buildah: buildah allows arbitrary directory mount

High 7.8

In plain English

A high-severity path traversal in buildah. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.4%top 66.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	aardvark-dns	2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:8	aardvark-dns	2:1.10.1-2.module_el8.10.0+3901+4b80ecd7	ALSA-2024:8846
AlmaLinux:8	buildah	2:1.33.10-1.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:9	buildah	2:1.37.5-1.el9_5	ALSA-2024:9459
AlmaLinux:9	buildah	2:1.33.10-1.el9_4	ALSA-2024:8563
AlmaLinux:8	buildah-tests	2:1.33.10-1.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:9	buildah-tests	2:1.33.10-1.el9_4	ALSA-2024:8563
AlmaLinux:9	buildah-tests	2:1.37.5-1.el9_5	ALSA-2024:9459
AlmaLinux:8	cockpit-podman	84.1-1.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+3901+4b80ecd7	ALSA-2024:8846
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+3845+87b84552	ALSA-2024:8846
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	container-selinux	2:2.229.0-2.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:8	containernetworking-plugins	1:1.4.0-5.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:8	containernetworking-plugins	1:1.4.0-5.module_el8.10.0+3901+4b80ecd7	ALSA-2024:8846
AlmaLinux:8	containernetworking-plugins	1:1.4.0-5.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	containers-common	2:1-82.module_el8.10.0+3901+4b80ecd7	ALSA-2024:8846
AlmaLinux:8	containers-common	2:1-82.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	crit	3.18-5.module_el8.10.0+3858+6ad51f9f	ALSA-2024:8846
AlmaLinux:8	crit	3.18-5.module_el8.10.0+3901+4b80ecd7	ALSA-2024:8846
AlmaLinux:8	crit	3.18-5.module_el8.10.0+3845+87b84552	ALSA-2024:8846
AlmaLinux:8	criu	3.18-5.module_el8.10.0+3845+87b84552	ALSA-2024:8846
AlmaLinux:8	criu	3.18-5.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:8	criu	3.18-5.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+3858+6ad51f9f	ALSA-2024:8846
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+3845+87b84552	ALSA-2024:8846
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+3845+87b84552	ALSA-2024:8846
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+3901+4b80ecd7	ALSA-2024:8846
AlmaLinux:8	crun	1.14.3-2.module_el8.10.0+3845+87b84552	ALSA-2024:8846
AlmaLinux:8	crun	1.14.3-2.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:8	crun	1.14.3-2.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+3901+4b80ecd7	ALSA-2024:8846
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+3792+03eaed9c	ALSA-2024:8846
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+3845+87b84552	ALSA-2024:8846
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+3858+6ad51f9f	ALSA-2024:8846
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+3901+4b80ecd7	ALSA-2024:8846
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+3845+87b84552	ALSA-2024:8846
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+3845+87b84552	ALSA-2024:8846
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+3901+4b80ecd7	ALSA-2024:8846
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+3858+6ad51f9f	ALSA-2024:8846
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+3792+03eaed9c	ALSA-2024:8846
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	podman	4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:9	podman	4:4.9.4-16.el9_4	ALSA-2024:9051
AlmaLinux:9	podman	4:5.2.2-9.el9_5	ALSA-2024:9454
AlmaLinux:8	podman-catatonit	4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:8	podman-docker	4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:9	podman-docker	4:5.2.2-9.el9_5	ALSA-2024:9454
AlmaLinux:9	podman-docker	4:4.9.4-16.el9_4	ALSA-2024:9051
AlmaLinux:8	podman-gvproxy	4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:8	podman-plugins	4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:9	podman-plugins	4:4.9.4-16.el9_4	ALSA-2024:9051
AlmaLinux:9	podman-plugins	4:5.2.2-9.el9_5	ALSA-2024:9454
AlmaLinux:8	podman-remote	4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:9	podman-remote	4:4.9.4-16.el9_4	ALSA-2024:9051
AlmaLinux:9	podman-remote	4:5.2.2-9.el9_5	ALSA-2024:9454
AlmaLinux:8	podman-tests	4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:9	podman-tests	4:5.2.2-9.el9_5	ALSA-2024:9454
AlmaLinux:9	podman-tests	4:4.9.4-16.el9_4	ALSA-2024:9051
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+3858+6ad51f9f	ALSA-2024:8846
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+3901+4b80ecd7	ALSA-2024:8846
AlmaLinux:8	python3-podman	4.9.0-2.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	runc	1:1.1.12-5.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:8	skopeo	2:1.14.5-3.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	skopeo	2:1.14.5-3.module_el8.10.0+3901+4b80ecd7	ALSA-2024:8846
AlmaLinux:8	skopeo	2:1.14.5-3.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:8	skopeo-tests	2:1.14.5-3.module_el8.10.0+3901+4b80ecd7	ALSA-2024:8846
AlmaLinux:8	skopeo-tests	2:1.14.5-3.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+3901+4b80ecd7	ALSA-2024:8846
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+3845+87b84552	ALSA-2024:8846
AlmaLinux:8	toolbox	0.0.99.5-2.module_el8.10.0+3901+4b80ecd7	ALSA-2024:8846
AlmaLinux:8	toolbox	0.0.99.5-2.module_el8.10.0+3858+6ad51f9f	ALSA-2024:8846
AlmaLinux:8	toolbox	0.0.99.5-2.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
AlmaLinux:8	toolbox	0.0.99.5-2.module_el8.10.0+3845+87b84552	ALSA-2024:8846
AlmaLinux:8	toolbox-tests	0.0.99.5-2.module_el8.10.0+3858+6ad51f9f	ALSA-2024:8846
AlmaLinux:8	toolbox-tests	0.0.99.5-2.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:8846
AlmaLinux:8	udica	0.2.6-21.module_el8.10.0+3876+e55593a8	ALSA-2024:8846
Alpine:v3.20	buildah	1.37.5-r0	ALPINE-CVE-2024-9675
Alpine:v3.21	buildah	1.37.5-r0	ALPINE-CVE-2024-9675
Alpine:v3.22	buildah	1.37.5-r0	ALPINE-CVE-2024-9675
Alpine:v3.23	buildah	1.37.5-r0	ALPINE-CVE-2024-9675
Alpine:v3.24	buildah	1.37.5-r0	ALPINE-CVE-2024-9675
Alpine:v3.20	podman	5.2.5-r0	ALPINE-CVE-2024-9675
Alpine:v3.21	podman	5.2.5-r0	ALPINE-CVE-2024-9675
Alpine:v3.22	podman	5.2.5-r0	ALPINE-CVE-2024-9675
Alpine:v3.23	podman	5.2.5-r0	ALPINE-CVE-2024-9675
Alpine:v3.24	podman	5.2.5-r0	ALPINE-CVE-2024-9675
Debian:12	golang-github-containers-buildah	no fix listed	DEBIAN-CVE-2024-9675
Debian:13	golang-github-containers-buildah	1.37.4+ds1-1	DEBIAN-CVE-2024-9675
Debian:14	golang-github-containers-buildah	1.37.4+ds1-1	DEBIAN-CVE-2024-9675
Go	github.com/containers/buildah	1.38.0	GHSA-586p-749j-fhwp
Go	github.com/containers/buildah	1.37.1	GO-2024-3186
Rocky Linux:9	buildah	2:1.33.10-1.el9_4	RLSA-2024:8563
Rocky Linux:9	podman	4:4.9.4-16.el9_4	RLSA-2024:9051
Ubuntu:22.04:LTS	golang-github-containers-buildah	no fix listed	UBUNTU-CVE-2024-9675

Affected products (as reported)

Vendor	Product	Versions
	buildah	0 – before 1.38.0
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	Red Hat OpenShift Container Platform 4.12	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.14	see references
Red Hat	Red Hat OpenShift Container Platform 4.14	see references
Red Hat	Red Hat OpenShift Container Platform 4.15	see references
Red Hat	Red Hat OpenShift Container Platform 4.15	see references
Red Hat	Red Hat OpenShift Container Platform 4.16	see references
Red Hat	Red Hat OpenShift Container Platform 4.16	see references
Red Hat	Red Hat OpenShift Container Platform 4.17	see references
Red Hat	Red Hat OpenShift Container Platform 4.17	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

RHBA-2024:10967 vendor-advisory, x_refsource_REDHAT
RHEA-2024:6126 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8563 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8675 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8679 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8686 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8690 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8700 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8703 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8707 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8708 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8709 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8846 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8984 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8994 vendor-advisory, x_refsource_REDHAT
RHSA-2024:9051 vendor-advisory, x_refsource_REDHAT
RHSA-2024:9454 vendor-advisory, x_refsource_REDHAT
RHSA-2024:9459 vendor-advisory, x_refsource_REDHAT
RHSA-2025:2445 vendor-advisory, x_refsource_REDHAT
RHSA-2025:2449 vendor-advisory, x_refsource_REDHAT
RHSA-2025:2454 vendor-advisory, x_refsource_REDHAT
RHSA-2025:2701 vendor-advisory, x_refsource_REDHAT
RHSA-2025:2710 vendor-advisory, x_refsource_REDHAT
RHSA-2025:3301 vendor-advisory, x_refsource_REDHAT
RHSA-2025:3573 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-9675 vdb-entry, x_refsource_REDHAT
RHBZ#2317458 issue-tracking, x_refsource_REDHAT