A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade runcUpgrade aardvark-dnsUpgrade python3-podmanUpgrade toolboxUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade cockpit-podmanUpgrade critUpgrade criuUpgrade slirp4netnsUpgrade toolbox-testsUpgrade podman-testsUpgrade buildahUpgrade skopeoUpgrade fuse-overlayfsUpgrade conmonUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade netavarkUpgrade udicaUpgrade podman-remoteUpgrade podmanUpgrade podman-dockerUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade python3-criuUpgrade criu-develUpgrade crunUpgrade containers-commonUpgrade podman-pluginsUpgrade skopeo-testsUpgrade container-selinuxUpgrade criu-libsUpgrade libslirp | Feb 10, 2025 | Jan 22, 2025 |
| Alpine Linux | — | Upgrade podmanUpgrade buildah | Aug 8, 2025 | Jan 22, 2025 |
| Debian | — | No solution existsUpgrade golang-github-containers-buildah | May 15, 2025 | Jan 22, 2025 |
| Oracle_linux | — | Upgrade buildah-testsUpgrade podman-dockerUpgrade buildahUpgrade container-selinuxUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade udicaUpgrade crunUpgrade libslirpUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade slirp4netnsUpgrade conmonUpgrade python3-podmanUpgrade python3-criuUpgrade podman-testsUpgrade containers-commonUpgrade criu-libsUpgrade containernetworking-pluginsUpgrade podmanUpgrade skopeo-testsUpgrade runcUpgrade podman-remoteUpgrade netavarkUpgrade critUpgrade criuUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade libslirp-develUpgrade criu-develUpgrade skopeoUpgrade podman-catatonit | Feb 4, 2025 | Jan 20, 2025 |
| Redhat Openshift | — | Upgrade podmanUpgrade buildahUpgrade rhcos | Feb 10, 2025 | Jan 20, 2025 |
| Redhat_linux | — | Upgrade podman-pluginsUpgrade buildah-debugsourceUpgrade buildah-tests-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-debugsourceUpgrade buildah-debuginfoUpgrade podmanUpgrade podman-dockerUpgrade podman-testsUpgrade buildahUpgrade podman-gvproxyUpgrade podman-remoteUpgrade podman-debuginfoUpgrade buildah-testsUpgrade podman-gvproxy-debuginfo | Feb 5, 2025 | Jan 22, 2025 |
| Rocky_linux | — | Upgrade toolbox-debuginfoUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-pluginsUpgrade podman-debugsourceUpgrade podman-pluginsUpgrade libslirp-debugsourceUpgrade criu-develUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade python3-criuUpgrade podmanUpgrade slirp4netns-debuginfoUpgrade podman-catatonit-debuginfoUpgrade conmon-debuginfoUpgrade slirp4netnsUpgrade toolbox-testsUpgrade slirp4netns-debugsourceUpgrade podman-gvproxyUpgrade criu-libs-debuginfoUpgrade podman-catatonitUpgrade criuUpgrade podman-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade critUpgrade skopeo-testsUpgrade podman-remoteUpgrade crunUpgrade podman-plugins-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade runcUpgrade podman-testsUpgrade toolbox-debugsourceUpgrade crun-debugsourceUpgrade buildah-tests-debuginfoUpgrade crun-debuginfoUpgrade buildahUpgrade toolboxUpgrade fuse-overlayfsUpgrade conmon-debugsourceUpgrade conmonUpgrade buildah-debuginfoUpgrade runc-debugsourceUpgrade criu-debuginfoUpgrade aardvark-dnsUpgrade netavarkUpgrade skopeoUpgrade runc-debuginfoUpgrade libslirpUpgrade fuse-overlayfs-debuginfoUpgrade criu-libsUpgrade criu-debugsourceUpgrade buildah-testsUpgrade oci-seccomp-bpf-hookUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containers-commonUpgrade podman-remote-debuginfoUpgrade libslirp-develUpgrade fuse-overlayfs-debugsource | Feb 14, 2025 | Jan 22, 2025 |
| Suse | — | Upgrade govulncheck-vulndbUpgrade podman-dockerUpgrade podmanshUpgrade podman-remoteUpgrade podmanUpgrade buildah | Dec 5, 2025 | Feb 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub