Vulnerability · Published Oct 1, 2024 · Assigned by redhat
CVE-2024-9407Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction
Medium 4.7
In plain English
A medium-severity improper input validation in buildah. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.3%top 78.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | aardvark-dns | 2:1.10.1-2.module_el8.10.0+3901+4b80ecd7 | ALSA-2024:8846 |
| AlmaLinux:8 | aardvark-dns | 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:8 | buildah | 2:1.33.10-1.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:9 | buildah | 2:1.37.5-1.el9_5 | ALSA-2024:9459 |
| AlmaLinux:8 | buildah-tests | 2:1.33.10-1.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:9 | buildah-tests | 2:1.37.5-1.el9_5 | ALSA-2024:9459 |
| AlmaLinux:8 | cockpit-podman | 84.1-1.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | conmon | 3:2.1.10-1.module_el8.10.0+3901+4b80ecd7 | ALSA-2024:8846 |
| AlmaLinux:8 | conmon | 3:2.1.10-1.module_el8.10.0+3845+87b84552 | ALSA-2024:8846 |
| AlmaLinux:8 | conmon | 3:2.1.10-1.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:8 | conmon | 3:2.1.10-1.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | container-selinux | 2:2.229.0-2.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.4.0-5.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.4.0-5.module_el8.10.0+3901+4b80ecd7 | ALSA-2024:8846 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.4.0-5.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | containers-common | 2:1-82.module_el8.10.0+3901+4b80ecd7 | ALSA-2024:8846 |
| AlmaLinux:8 | containers-common | 2:1-82.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | crit | 3.18-5.module_el8.10.0+3858+6ad51f9f | ALSA-2024:8846 |
| AlmaLinux:8 | crit | 3.18-5.module_el8.10.0+3901+4b80ecd7 | ALSA-2024:8846 |
| AlmaLinux:8 | crit | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:8846 |
| AlmaLinux:8 | criu | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:8846 |
| AlmaLinux:8 | criu | 3.18-5.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:8 | criu | 3.18-5.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | criu-devel | 3.18-5.module_el8.10.0+3858+6ad51f9f | ALSA-2024:8846 |
| AlmaLinux:8 | criu-devel | 3.18-5.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | criu-devel | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:8846 |
| AlmaLinux:8 | criu-libs | 3.18-5.module_el8.10.0+3901+4b80ecd7 | ALSA-2024:8846 |
| AlmaLinux:8 | criu-libs | 3.18-5.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:8 | criu-libs | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:8846 |
| AlmaLinux:8 | crun | 1.14.3-2.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | crun | 1.14.3-2.module_el8.10.0+3845+87b84552 | ALSA-2024:8846 |
| AlmaLinux:8 | crun | 1.14.3-2.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:8 | fuse-overlayfs | 1.13-1.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:8 | fuse-overlayfs | 1.13-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:8846 |
| AlmaLinux:8 | fuse-overlayfs | 1.13-1.module_el8.10.0+3901+4b80ecd7 | ALSA-2024:8846 |
| AlmaLinux:8 | libslirp | 4.4.0-2.module_el8.10.0+3845+87b84552 | ALSA-2024:8846 |
| AlmaLinux:8 | libslirp | 4.4.0-2.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | libslirp | 4.4.0-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:8846 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-2.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-2.module_el8.10.0+3901+4b80ecd7 | ALSA-2024:8846 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-2.module_el8.10.0+3845+87b84552 | ALSA-2024:8846 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-2.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:8 | netavark | 2:1.10.3-1.module_el8.10.0+3858+6ad51f9f | ALSA-2024:8846 |
| AlmaLinux:8 | netavark | 2:1.10.3-1.module_el8.10.0+3901+4b80ecd7 | ALSA-2024:8846 |
| AlmaLinux:8 | netavark | 2:1.10.3-1.module_el8.10.0+3845+87b84552 | ALSA-2024:8846 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:8846 |
| AlmaLinux:8 | podman | 4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:9 | podman | 4:4.9.4-16.el9_4 | ALSA-2024:9051 |
| AlmaLinux:9 | podman | 4:5.2.2-9.el9_5 | ALSA-2024:9454 |
| AlmaLinux:8 | podman-catatonit | 4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:8 | podman-docker | 4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:9 | podman-docker | 4:4.9.4-16.el9_4 | ALSA-2024:9051 |
| AlmaLinux:9 | podman-docker | 4:5.2.2-9.el9_5 | ALSA-2024:9454 |
| AlmaLinux:8 | podman-gvproxy | 4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:8 | podman-plugins | 4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:9 | podman-plugins | 4:4.9.4-16.el9_4 | ALSA-2024:9051 |
| AlmaLinux:9 | podman-plugins | 4:5.2.2-9.el9_5 | ALSA-2024:9454 |
| AlmaLinux:8 | podman-remote | 4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:9 | podman-remote | 4:4.9.4-16.el9_4 | ALSA-2024:9051 |
| AlmaLinux:9 | podman-remote | 4:5.2.2-9.el9_5 | ALSA-2024:9454 |
| AlmaLinux:8 | podman-tests | 4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:9 | podman-tests | 4:5.2.2-9.el9_5 | ALSA-2024:9454 |
| AlmaLinux:9 | podman-tests | 4:4.9.4-16.el9_4 | ALSA-2024:9051 |
| AlmaLinux:8 | python3-criu | 3.18-5.module_el8.10.0+3901+4b80ecd7 | ALSA-2024:8846 |
| AlmaLinux:8 | python3-criu | 3.18-5.module_el8.10.0+3858+6ad51f9f | ALSA-2024:8846 |
| AlmaLinux:8 | python3-criu | 3.18-5.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | python3-podman | 4.9.0-2.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | runc | 1:1.1.12-5.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:8 | skopeo | 2:1.14.5-3.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:8 | skopeo | 2:1.14.5-3.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | skopeo | 2:1.14.5-3.module_el8.10.0+3901+4b80ecd7 | ALSA-2024:8846 |
| AlmaLinux:8 | skopeo-tests | 2:1.14.5-3.module_el8.10.0+3901+4b80ecd7 | ALSA-2024:8846 |
| AlmaLinux:8 | skopeo-tests | 2:1.14.5-3.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | slirp4netns | 1.2.3-1.module_el8.10.0+3901+4b80ecd7 | ALSA-2024:8846 |
| AlmaLinux:8 | slirp4netns | 1.2.3-1.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | slirp4netns | 1.2.3-1.module_el8.10.0+3845+87b84552 | ALSA-2024:8846 |
| AlmaLinux:8 | toolbox | 0.0.99.5-2.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| AlmaLinux:8 | toolbox | 0.0.99.5-2.module_el8.10.0+3845+87b84552 | ALSA-2024:8846 |
| AlmaLinux:8 | toolbox | 0.0.99.5-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:8846 |
| AlmaLinux:8 | toolbox | 0.0.99.5-2.module_el8.10.0+3901+4b80ecd7 | ALSA-2024:8846 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.5-2.module_el8.10.0+3909+6e1c1eb7 | ALSA-2024:8846 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.5-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:8846 |
| AlmaLinux:8 | udica | 0.2.6-21.module_el8.10.0+3876+e55593a8 | ALSA-2024:8846 |
| Alpine:v3.20 | buildah | 1.37.4-r0 | ALPINE-CVE-2024-9407 |
| Alpine:v3.21 | buildah | 1.37.4-r0 | ALPINE-CVE-2024-9407 |
| Alpine:v3.22 | buildah | 1.37.4-r0 | ALPINE-CVE-2024-9407 |
| Alpine:v3.23 | buildah | 1.37.4-r0 | ALPINE-CVE-2024-9407 |
| Alpine:v3.24 | buildah | 1.37.4-r0 | ALPINE-CVE-2024-9407 |
| Alpine:v3.20 | podman | 5.2.4-r0 | ALPINE-CVE-2024-9407 |
| Alpine:v3.21 | podman | 5.2.4-r0 | ALPINE-CVE-2024-9407 |
| Alpine:v3.22 | podman | 5.2.4-r0 | ALPINE-CVE-2024-9407 |
| Alpine:v3.23 | podman | 5.2.4-r0 | ALPINE-CVE-2024-9407 |
| Alpine:v3.24 | podman | 5.2.4-r0 | ALPINE-CVE-2024-9407 |
| Debian:12 | golang-github-containers-buildah | no fix listed | DEBIAN-CVE-2024-9407 |
| Debian:13 | golang-github-containers-buildah | 1.37.4+ds1-1 | DEBIAN-CVE-2024-9407 |
| Debian:14 | golang-github-containers-buildah | 1.37.4+ds1-1 | DEBIAN-CVE-2024-9407 |
| Go | github.com/containers/buildah | 1.37.4 | GHSA-fhqq-8f65-5xfc |
| Go | github.com/containers/buildah | 1.37.4 | GO-2024-3169 |
| Go | github.com/containers/podman | 5.2.4 | GHSA-fhqq-8f65-5xfc |
| Go | github.com/containers/podman | no fix listed | GO-2024-3169 |
| Go | github.com/containers/podman/v2 | no fix listed | GO-2024-3169 |
| Go | github.com/containers/podman/v2 | 5.2.4 | GHSA-fhqq-8f65-5xfc |
| Go | github.com/containers/podman/v3 | 5.2.4 | GHSA-fhqq-8f65-5xfc |
| Go | github.com/containers/podman/v3 | no fix listed | GO-2024-3169 |
| Go | github.com/containers/podman/v4 | no fix listed | GO-2024-3169 |
| Go | github.com/containers/podman/v4 | 5.2.4 | GHSA-fhqq-8f65-5xfc |
| Go | github.com/containers/podman/v5 | 5.2.4 | GHSA-fhqq-8f65-5xfc |
| Go | github.com/containers/podman/v5 | 5.2.4 | GO-2024-3169 |
| Rocky Linux:9 | podman | 4:4.9.4-16.el9_4 | RLSA-2024:9051 |
| Ubuntu:22.04:LTS | golang-github-containers-buildah | no fix listed | UBUNTU-CVE-2024-9407 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| podman | 0 – before 5.2.4 | |
| buildah | 0 – before 1.37.4 | |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N
References
- RHSA-2024:10147 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:8846 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:9051 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:9454 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:9459 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:9926 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-9407 vdb-entry, x_refsource_REDHAT
- RHBZ#2315887 issue-tracking, x_refsource_REDHAT
- https://github.com/advisories/GHSA-fhqq-8f65-5xfc
- https://security.netapp.com/advisory/ntap-20241220-0010/