A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-catatonitUpgrade critUpgrade toolbox-testsUpgrade podmanUpgrade podman-dockerUpgrade runcUpgrade aardvark-dnsUpgrade udicaUpgrade fuse-overlayfsUpgrade podman-testsUpgrade criuUpgrade buildahUpgrade skopeoUpgrade slirp4netnsUpgrade toolboxUpgrade cockpit-podmanUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade buildah-testsUpgrade python3-podmanUpgrade podman-gvproxyUpgrade netavarkUpgrade conmonUpgrade crunUpgrade container-selinuxUpgrade podman-pluginsUpgrade python3-criuUpgrade criu-libsUpgrade libslirp-develUpgrade containers-commonUpgrade libslirpUpgrade skopeo-testsUpgrade criu-develUpgrade oci-seccomp-bpf-hook | Feb 10, 2025 | Jan 22, 2025 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Aug 8, 2025 | Jan 22, 2025 |
| Debian | — | Upgrade golang-github-containers-buildah | May 15, 2025 | Jan 22, 2025 |
| Oracle_linux | — | Upgrade crunUpgrade udicaUpgrade buildahUpgrade aardvark-dnsUpgrade buildah-testsUpgrade container-selinuxUpgrade podman-testsUpgrade python3-podmanUpgrade slirp4netnsUpgrade podman-dockerUpgrade cockpit-podmanUpgrade libslirpUpgrade conmonUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade python3-criuUpgrade runcUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade netavarkUpgrade critUpgrade criuUpgrade containernetworking-pluginsUpgrade skopeo-testsUpgrade podmanUpgrade criu-libsUpgrade podman-remoteUpgrade libslirp-develUpgrade skopeoUpgrade podman-pluginsUpgrade podman-catatonitUpgrade criu-devel | Feb 4, 2025 | Jan 20, 2025 |
| Redhat Openshift | — | Upgrade rhcosUpgrade buildahUpgrade podman | Feb 10, 2025 | Jan 20, 2025 |
| Redhat_linux | — | Upgrade buildah-testsUpgrade podman-debuginfoUpgrade podman-testsUpgrade podman-gvproxy-debuginfoUpgrade buildahUpgrade podmanUpgrade podman-dockerUpgrade podman-remoteUpgrade podman-gvproxyUpgrade buildah-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-remote-debuginfoUpgrade buildah-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-debugsourceUpgrade podman-plugins | Feb 5, 2025 | Jan 22, 2025 |
| Rocky_linux | — | Upgrade runcUpgrade buildah-debugsourceUpgrade containernetworking-pluginsUpgrade slirp4netns-debugsourceUpgrade criu-libs-debuginfoUpgrade podman-debuginfoUpgrade podman-gvproxyUpgrade libslirp-debuginfoUpgrade criuUpgrade podman-catatonit-debuginfoUpgrade podman-remoteUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-catatonitUpgrade podman-pluginsUpgrade podman-plugins-debuginfoUpgrade libslirp-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade podman-testsUpgrade crunUpgrade toolbox-debuginfoUpgrade podman-debugsourceUpgrade conmon-debuginfoUpgrade toolbox-debugsourceUpgrade toolbox-testsUpgrade podmanUpgrade skopeo-testsUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netns-debuginfoUpgrade slirp4netnsUpgrade critUpgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade podman-remote-debuginfoUpgrade skopeoUpgrade runc-debuginfoUpgrade libslirpUpgrade fuse-overlayfs-debugsourceUpgrade libslirp-develUpgrade toolboxUpgrade fuse-overlayfsUpgrade buildah-tests-debuginfoUpgrade netavarkUpgrade crun-debuginfoUpgrade criu-debuginfoUpgrade aardvark-dnsUpgrade buildahUpgrade crun-debugsourceUpgrade conmon-debugsourceUpgrade conmonUpgrade buildah-debuginfoUpgrade runc-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade criu-libsUpgrade criu-debugsourceUpgrade buildah-tests | Feb 14, 2025 | Jan 22, 2025 |
| Suse | — | Upgrade podmanUpgrade podmanshUpgrade podman-remoteUpgrade buildahUpgrade podman-dockerUpgrade govulncheck-vulndb | Dec 5, 2025 | Feb 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub