A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirp-develUpgrade python3-criuUpgrade aardvark-dnsUpgrade criu-libsUpgrade runcUpgrade container-selinuxUpgrade containernetworking-pluginsUpgrade podmanUpgrade podman-remoteUpgrade containers-commonUpgrade buildahUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade critUpgrade fuse-overlayfsUpgrade crunUpgrade criuUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade libslirpUpgrade netavarkUpgrade podman-catatonitUpgrade udicaUpgrade podman-testsUpgrade podman-pluginsUpgrade podman-gvproxyUpgrade toolboxUpgrade podman-dockerUpgrade skopeo-testsUpgrade toolbox-testsUpgrade python3-podmanUpgrade buildah-testsUpgrade conmonUpgrade criu-devel | Nov 7, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade podmanUpgrade buildah | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | Upgrade golang-github-containers-buildah | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade podman-catatonitUpgrade critUpgrade fuse-overlayfsUpgrade skopeoUpgrade runcUpgrade criuUpgrade containernetworking-pluginsUpgrade buildahUpgrade podmanUpgrade podman-remoteUpgrade podman-pluginsUpgrade netavarkUpgrade aardvark-dnsUpgrade podman-dockerUpgrade oci-seccomp-bpf-hookUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade podman-testsUpgrade podman-gvproxyUpgrade containers-commonUpgrade skopeo-testsUpgrade criu-libsUpgrade libslirpUpgrade python3-podmanUpgrade crunUpgrade buildah-testsUpgrade libslirp-develUpgrade criu-develUpgrade python3-criuUpgrade container-selinuxUpgrade conmon | Nov 11, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Nov 27, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade criu-debuginfoUpgrade criu-debugsourceUpgrade python3-podmanUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade criuUpgrade aardvark-dnsUpgrade criu-libsUpgrade netavarkUpgrade fuse-overlayfs-debuginfoUpgrade conmon-debugsourceUpgrade buildahUpgrade fuse-overlayfs-debugsourceUpgrade toolbox-testsUpgrade crun-debugsourceUpgrade containernetworking-pluginsUpgrade buildah-debuginfoUpgrade runc-debugsourceUpgrade cockpit-podmanUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade crun-debuginfoUpgrade podman-remoteUpgrade podmanUpgrade buildah-tests-debuginfoUpgrade podman-catatonitUpgrade conmon-debuginfoUpgrade criu-develUpgrade podman-pluginsUpgrade container-selinuxUpgrade podman-dockerUpgrade libslirpUpgrade udicaUpgrade runcUpgrade slirp4netns-debuginfoUpgrade libslirp-debuginfoUpgrade podman-debuginfoUpgrade toolbox-debuginfoUpgrade podman-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade runc-debuginfoUpgrade buildah-debugsourceUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmonUpgrade crunUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade toolbox-debugsourceUpgrade podman-remote-debuginfoUpgrade libslirp-debugsourceUpgrade toolboxUpgrade podman-catatonit-debuginfoUpgrade podman-testsUpgrade libslirp-develUpgrade criu-libs-debuginfoUpgrade podman-gvproxyUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-testsUpgrade podman-debugsourceUpgrade skopeoUpgrade podman-gvproxy-debuginfoUpgrade critUpgrade slirp4netns | Nov 7, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade conmon-debugsourceUpgrade libslirp-debugsourceUpgrade criuUpgrade critUpgrade runcUpgrade toolbox-debugsourceUpgrade fuse-overlayfsUpgrade buildah-debugsourceUpgrade toolboxUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-pluginsUpgrade buildah-testsUpgrade netavarkUpgrade podman-catatonitUpgrade toolbox-testsUpgrade fuse-overlayfs-debuginfoUpgrade python3-criuUpgrade skopeoUpgrade criu-libs-debuginfoUpgrade criu-debugsourceUpgrade crunUpgrade podman-catatonit-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade podman-debuginfoUpgrade podman-remoteUpgrade buildah-debuginfoUpgrade libslirp-debuginfoUpgrade buildahUpgrade toolbox-debuginfoUpgrade podmanUpgrade runc-debuginfoUpgrade podman-pluginsUpgrade slirp4netns-debuginfoUpgrade libslirpUpgrade crun-debugsourceUpgrade buildah-tests-debuginfoUpgrade runc-debugsourceUpgrade podman-gvproxyUpgrade libslirp-develUpgrade containernetworking-plugins-debugsourceUpgrade podman-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-develUpgrade conmon-debuginfoUpgrade crun-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-plugins-debuginfoUpgrade criu-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-plugins-debuginfoUpgrade conmonUpgrade containers-commonUpgrade podman-remote-debuginfoUpgrade criu-libsUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade podman-debugsourceUpgrade skopeo-tests | Nov 19, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade podman-dockerUpgrade buildahUpgrade govulncheck-vulndbUpgrade podmanshUpgrade podmanUpgrade podman-remote | Dec 31, 2024 | Oct 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 2, 2026 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub