A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirpUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade criu-develUpgrade libslirp-develUpgrade container-selinuxUpgrade crunUpgrade containers-commonUpgrade python3-criuUpgrade podman-pluginsUpgrade udicaUpgrade cockpit-podmanUpgrade containernetworking-pluginsUpgrade conmonUpgrade python3-podmanUpgrade podman-gvproxyUpgrade buildah-testsUpgrade netavarkUpgrade podman-testsUpgrade skopeoUpgrade aardvark-dnsUpgrade runcUpgrade podman-remoteUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade slirp4netnsUpgrade critUpgrade criuUpgrade buildahUpgrade podman-dockerUpgrade podmanUpgrade toolboxUpgrade toolbox-tests | Feb 10, 2025 | Jan 22, 2025 |
| Alpine Linux | — | Upgrade podmanUpgrade buildah | Aug 8, 2025 | Jan 22, 2025 |
| Debian | — | No solution existsUpgrade golang-github-containers-buildah | May 15, 2025 | Jan 22, 2025 |
| Oracle_linux | — | Upgrade netavarkUpgrade runcUpgrade podman-pluginsUpgrade critUpgrade skopeo-testsUpgrade podman-remoteUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade podman-catatonitUpgrade podmanUpgrade containers-commonUpgrade criu-develUpgrade containernetworking-pluginsUpgrade libslirp-develUpgrade skopeoUpgrade criuUpgrade buildah-testsUpgrade buildahUpgrade aardvark-dnsUpgrade python3-podmanUpgrade podman-testsUpgrade container-selinuxUpgrade python3-criuUpgrade podman-gvproxyUpgrade podman-dockerUpgrade crunUpgrade udicaUpgrade fuse-overlayfsUpgrade cockpit-podmanUpgrade libslirpUpgrade conmonUpgrade slirp4netns | Feb 4, 2025 | Jan 20, 2025 |
| Redhat Openshift | — | Upgrade podmanUpgrade buildahUpgrade rhcos | Feb 10, 2025 | Jan 20, 2025 |
| Redhat_linux | — | Upgrade buildah-tests-debuginfoUpgrade podman-debugsourceUpgrade podman-pluginsUpgrade podman-remote-debuginfoUpgrade buildah-debugsourceUpgrade podman-plugins-debuginfoUpgrade buildah-testsUpgrade buildahUpgrade podman-testsUpgrade podman-dockerUpgrade podman-debuginfoUpgrade buildah-debuginfoUpgrade podmanUpgrade podman-remoteUpgrade podman-gvproxy-debuginfoUpgrade podman-gvproxy | Feb 5, 2025 | Jan 22, 2025 |
| Rocky_linux | — | Upgrade fuse-overlayfsUpgrade crun-debugsourceUpgrade buildahUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade buildah-debuginfoUpgrade toolboxUpgrade buildah-tests-debuginfoUpgrade conmonUpgrade conmon-debugsourceUpgrade containers-commonUpgrade runc-debugsourceUpgrade aardvark-dnsUpgrade podman-remote-debuginfoUpgrade libslirp-develUpgrade fuse-overlayfs-debugsourceUpgrade criu-libsUpgrade crun-debuginfoUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade netavarkUpgrade fuse-overlayfs-debuginfoUpgrade buildah-testsUpgrade criu-debuginfoUpgrade criu-debugsourceUpgrade runc-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade toolbox-debuginfoUpgrade skopeo-testsUpgrade podman-debuginfoUpgrade podman-catatonitUpgrade criu-libs-debuginfoUpgrade podman-testsUpgrade podman-gvproxy-debuginfoUpgrade crunUpgrade critUpgrade criu-develUpgrade toolbox-debugsourceUpgrade podman-gvproxyUpgrade runcUpgrade slirp4netns-debugsourceUpgrade podmanUpgrade containernetworking-pluginsUpgrade podman-plugins-debuginfoUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirp-debugsourceUpgrade libslirp-debuginfoUpgrade python3-criuUpgrade criuUpgrade podman-remoteUpgrade podman-pluginsUpgrade podman-catatonit-debuginfoUpgrade conmon-debuginfoUpgrade slirp4netnsUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade toolbox-tests | Feb 14, 2025 | Jan 22, 2025 |
| Suse | — | Upgrade podman-dockerUpgrade podmanUpgrade podman-remoteUpgrade buildahUpgrade podmanshUpgrade govulncheck-vulndb | Dec 5, 2025 | Feb 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub