A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade netavarkUpgrade podman-pluginsUpgrade fuse-overlayfsUpgrade buildah-testsUpgrade cockpit-podmanUpgrade toolboxUpgrade libslirpUpgrade toolbox-testsUpgrade udicaUpgrade conmonUpgrade podman-testsUpgrade critUpgrade python3-podmanUpgrade criuUpgrade podman-dockerUpgrade podman-catatonitUpgrade criu-develUpgrade skopeo-testsUpgrade slirp4netnsUpgrade crunUpgrade podman-gvproxyUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade container-selinuxUpgrade aardvark-dnsUpgrade skopeoUpgrade containernetworking-pluginsUpgrade runcUpgrade podmanUpgrade containers-commonUpgrade libslirp-develUpgrade buildahUpgrade podman-remote | Nov 7, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | Upgrade golang-github-containers-buildah | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade criuUpgrade netavarkUpgrade runcUpgrade podmanUpgrade buildahUpgrade podman-remoteUpgrade podman-catatonitUpgrade skopeoUpgrade critUpgrade containernetworking-pluginsUpgrade fuse-overlayfsUpgrade podman-pluginsUpgrade python3-podmanUpgrade libslirpUpgrade criu-libsUpgrade skopeo-testsUpgrade buildah-testsUpgrade podman-dockerUpgrade oci-seccomp-bpf-hookUpgrade libslirp-develUpgrade container-selinuxUpgrade conmonUpgrade aardvark-dnsUpgrade crunUpgrade podman-gvproxyUpgrade podman-testsUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade containers-commonUpgrade criu-develUpgrade python3-criu | Nov 11, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade rhcos | Nov 27, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade container-selinuxUpgrade slirp4netns-debuginfoUpgrade skopeo-testsUpgrade podman-debugsourceUpgrade podman-gvproxyUpgrade toolbox-debugsourceUpgrade podman-pluginsUpgrade containernetworking-plugins-debuginfoUpgrade libslirp-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-dockerUpgrade slirp4netnsUpgrade runcUpgrade podman-debuginfoUpgrade buildah-debugsourceUpgrade toolbox-debuginfoUpgrade critUpgrade crunUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade runc-debuginfoUpgrade conmonUpgrade criu-libs-debuginfoUpgrade libslirpUpgrade podman-catatonit-debuginfoUpgrade podman-testsUpgrade skopeoUpgrade toolboxUpgrade libslirp-develUpgrade udicaUpgrade slirp4netns-debugsourceUpgrade criu-develUpgrade libslirp-debuginfoUpgrade podman-remote-debuginfoUpgrade crun-debuginfoUpgrade toolbox-testsUpgrade criu-libsUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade podmanUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonitUpgrade runc-debugsourceUpgrade containers-commonUpgrade cockpit-podmanUpgrade buildah-testsUpgrade criu-debugsourceUpgrade python3-podmanUpgrade oci-seccomp-bpf-hookUpgrade conmon-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildahUpgrade crun-debugsourceUpgrade buildah-tests-debuginfoUpgrade conmon-debugsourceUpgrade netavarkUpgrade fuse-overlayfsUpgrade criuUpgrade aardvark-dns | Nov 7, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade podman-remoteUpgrade fuse-overlayfs-debuginfoUpgrade buildah-testsUpgrade podman-catatonitUpgrade runcUpgrade podman-catatonit-debuginfoUpgrade toolbox-debugsourceUpgrade python3-criuUpgrade toolboxUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-libs-debuginfoUpgrade containernetworking-pluginsUpgrade skopeoUpgrade podman-gvproxy-debuginfoUpgrade toolbox-debuginfoUpgrade podman-debuginfoUpgrade buildahUpgrade buildah-debuginfoUpgrade libslirp-debugsourceUpgrade conmon-debugsourceUpgrade podmanUpgrade netavarkUpgrade fuse-overlayfsUpgrade criuUpgrade critUpgrade buildah-debugsourceUpgrade criu-debugsourceUpgrade toolbox-testsUpgrade libslirp-debuginfoUpgrade crunUpgrade containernetworking-plugins-debugsourceUpgrade libslirpUpgrade podman-gvproxyUpgrade runc-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfoUpgrade crun-debugsource | Nov 19, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade podman-dockerUpgrade govulncheck-vulndbUpgrade buildahUpgrade podmanshUpgrade podman-remoteUpgrade podman | Dec 31, 2024 | Oct 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 2, 2026 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub