A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade containernetworking-pluginsUpgrade buildah-testsUpgrade python3-podmanUpgrade skopeoUpgrade podman-testsUpgrade aardvark-dnsUpgrade conmonUpgrade cockpit-podmanUpgrade runcUpgrade criuUpgrade fuse-overlayfsUpgrade udicaUpgrade podmanUpgrade podman-gvproxyUpgrade buildahUpgrade slirp4netnsUpgrade toolboxUpgrade podman-dockerUpgrade podman-catatonitUpgrade toolbox-testsUpgrade critUpgrade netavarkUpgrade podman-remoteUpgrade libslirp-develUpgrade podman-pluginsUpgrade python3-criuUpgrade libslirpUpgrade containers-commonUpgrade crunUpgrade criu-libsUpgrade skopeo-testsUpgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade container-selinux | Feb 10, 2025 | Jan 22, 2025 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Aug 8, 2025 | Jan 22, 2025 |
| Debian | — | No solution existsUpgrade golang-github-containers-buildah | May 15, 2025 | Jan 22, 2025 |
| Oracle_linux | — | Upgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade podman-remoteUpgrade skopeoUpgrade podman-catatonitUpgrade criuUpgrade netavarkUpgrade critUpgrade criu-libsUpgrade criu-develUpgrade skopeo-testsUpgrade podmanUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade runcUpgrade buildahUpgrade podman-testsUpgrade aardvark-dnsUpgrade podman-dockerUpgrade crunUpgrade python3-podmanUpgrade udicaUpgrade fuse-overlayfsUpgrade cockpit-podmanUpgrade conmonUpgrade slirp4netnsUpgrade libslirpUpgrade python3-criuUpgrade podman-gvproxyUpgrade container-selinuxUpgrade buildah-tests | Feb 4, 2025 | Jan 20, 2025 |
| Redhat Openshift | — | Upgrade rhcosUpgrade buildahUpgrade podman | Feb 10, 2025 | Jan 20, 2025 |
| Redhat_linux | — | Upgrade buildah-tests-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-debugsourceUpgrade buildah-debugsourceUpgrade podman-remote-debuginfoUpgrade podman-pluginsUpgrade podman-dockerUpgrade podman-testsUpgrade podman-gvproxy-debuginfoUpgrade podman-remoteUpgrade podmanUpgrade podman-gvproxyUpgrade buildah-debuginfoUpgrade buildahUpgrade podman-debuginfoUpgrade buildah-tests | Feb 5, 2025 | Jan 22, 2025 |
| Rocky_linux | — | Upgrade podman-debuginfoUpgrade skopeo-testsUpgrade podman-catatonitUpgrade toolbox-testsUpgrade criu-libs-debuginfoUpgrade containernetworking-pluginsUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade python3-criuUpgrade podman-plugins-debuginfoUpgrade libslirp-debuginfoUpgrade podman-gvproxyUpgrade slirp4netns-debugsourceUpgrade podman-remoteUpgrade conmon-debuginfoUpgrade podman-catatonit-debuginfoUpgrade slirp4netns-debuginfoUpgrade runcUpgrade slirp4netnsUpgrade toolbox-debugsourceUpgrade critUpgrade toolbox-debuginfoUpgrade criu-develUpgrade libslirp-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade criuUpgrade podman-debugsourceUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-testsUpgrade podman-gvproxy-debuginfoUpgrade podmanUpgrade crunUpgrade libslirpUpgrade fuse-overlayfs-debuginfoUpgrade criu-libsUpgrade criu-debugsourceUpgrade buildah-testsUpgrade skopeoUpgrade crun-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade buildahUpgrade criu-debuginfoUpgrade crun-debuginfoUpgrade aardvark-dnsUpgrade netavarkUpgrade libslirp-develUpgrade containers-commonUpgrade podman-remote-debuginfoUpgrade conmonUpgrade runc-debugsourceUpgrade conmon-debugsourceUpgrade buildah-debuginfoUpgrade toolboxUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-tests-debuginfoUpgrade runc-debuginfo | Feb 14, 2025 | Jan 22, 2025 |
| Suse | — | Upgrade podman-dockerUpgrade podmanUpgrade podman-remoteUpgrade buildahUpgrade podmanshUpgrade govulncheck-vulndb | Dec 5, 2025 | Feb 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub