A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade criu-develUpgrade libslirp-develUpgrade python3-criuUpgrade containers-commonUpgrade podman-pluginsUpgrade container-selinuxUpgrade crunUpgrade skopeo-testsUpgrade criu-libsUpgrade libslirpUpgrade oci-seccomp-bpf-hookUpgrade buildah-testsUpgrade aardvark-dnsUpgrade buildahUpgrade slirp4netnsUpgrade toolboxUpgrade cockpit-podmanUpgrade runcUpgrade podmanUpgrade containernetworking-pluginsUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade podman-remoteUpgrade skopeoUpgrade netavarkUpgrade python3-podmanUpgrade podman-gvproxyUpgrade podman-testsUpgrade conmonUpgrade critUpgrade criuUpgrade toolbox-testsUpgrade podman-dockerUpgrade udica | Feb 10, 2025 | Jan 22, 2025 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Aug 8, 2025 | Jan 22, 2025 |
| Debian | — | Upgrade golang-github-containers-buildahNo solution exists | May 15, 2025 | Jan 22, 2025 |
| Oracle_linux | — | Upgrade podman-catatonitUpgrade podman-remoteUpgrade criuUpgrade critUpgrade podman-pluginsUpgrade netavarkUpgrade criu-libsUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade runcUpgrade podmanUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hookUpgrade libslirp-develUpgrade skopeoUpgrade criu-develUpgrade podman-gvproxyUpgrade container-selinuxUpgrade buildahUpgrade fuse-overlayfsUpgrade podman-testsUpgrade aardvark-dnsUpgrade crunUpgrade udicaUpgrade podman-dockerUpgrade buildah-testsUpgrade cockpit-podmanUpgrade python3-podmanUpgrade slirp4netnsUpgrade libslirpUpgrade conmonUpgrade python3-criu | Feb 4, 2025 | Jan 20, 2025 |
| Redhat Openshift | — | Upgrade buildahUpgrade rhcosUpgrade podman | Feb 10, 2025 | Jan 20, 2025 |
| Redhat_linux | — | Upgrade buildah-testsUpgrade podman-remoteUpgrade podman-gvproxy-debuginfoUpgrade podman-gvproxyUpgrade podman-testsUpgrade podman-dockerUpgrade podmanUpgrade podman-debuginfoUpgrade buildahUpgrade buildah-debuginfoUpgrade podman-debugsourceUpgrade buildah-tests-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade buildah-debugsourceUpgrade podman-plugins | Feb 5, 2025 | Jan 22, 2025 |
| Rocky_linux | — | Upgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirpUpgrade crun-debugsourceUpgrade crun-debuginfoUpgrade buildahUpgrade criu-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfoUpgrade conmon-debugsourceUpgrade runc-debugsourceUpgrade libslirp-develUpgrade buildah-debuginfoUpgrade conmonUpgrade containers-commonUpgrade podman-remote-debuginfoUpgrade netavarkUpgrade runc-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hookUpgrade toolboxUpgrade skopeoUpgrade criu-libsUpgrade buildah-testsUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-testsUpgrade podman-gvproxy-debuginfoUpgrade crunUpgrade podman-remoteUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade podmanUpgrade toolbox-debugsourceUpgrade critUpgrade podman-debugsourceUpgrade skopeo-testsUpgrade podman-debuginfoUpgrade podman-catatonitUpgrade criu-libs-debuginfoUpgrade criuUpgrade python3-criuUpgrade slirp4netns-debuginfoUpgrade slirp4netnsUpgrade podman-catatonit-debuginfoUpgrade conmon-debuginfoUpgrade slirp4netns-debugsourceUpgrade runcUpgrade podman-gvproxyUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade toolbox-testsUpgrade criu-develUpgrade podman-pluginsUpgrade libslirp-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade toolbox-debuginfo | Feb 14, 2025 | Jan 22, 2025 |
| Suse | — | Upgrade govulncheck-vulndbUpgrade podman-remoteUpgrade podmanUpgrade podman-dockerUpgrade buildahUpgrade podmansh | Dec 5, 2025 | Feb 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub