A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade slirp4netnsUpgrade oci-seccomp-bpf-hookUpgrade python3-podmanUpgrade netavarkUpgrade libslirp-develUpgrade containers-commonUpgrade aardvark-dnsUpgrade cockpit-podmanUpgrade conmonUpgrade skopeo-testsUpgrade podman-pluginsUpgrade podman-testsUpgrade libslirpUpgrade podman-gvproxyUpgrade criu-libsUpgrade container-selinuxUpgrade criu-develUpgrade podman-remoteUpgrade buildah-testsUpgrade podmanUpgrade runcUpgrade toolbox-testsUpgrade python3-criuUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade skopeoUpgrade udicaUpgrade criuUpgrade toolboxUpgrade buildahUpgrade containernetworking-pluginsUpgrade podman-dockerUpgrade critUpgrade crun | Apr 30, 2024 | Mar 18, 2024 |
| Alpine Linux | — | Upgrade podmanUpgrade buildah | Aug 22, 2024 | Mar 18, 2024 |
| Debian | — | Upgrade golang-github-containers-buildah | May 15, 2025 | Mar 18, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Dec 19, 2024 |
| Gentoo Linux | — | Upgrade app-containers/podman.Upgrade app-containers/buildah. | Jul 9, 2024 | Mar 18, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade crunUpgrade podman-pluginsUpgrade criu-libsUpgrade skopeo-testsUpgrade skopeoUpgrade podman-remoteUpgrade libslirp-develUpgrade container-selinuxUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade podmanUpgrade python3-criuUpgrade aardvark-dnsUpgrade critUpgrade buildahUpgrade cockpit-podmanUpgrade udicaUpgrade criuUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade buildah-testsUpgrade runcUpgrade libslirpUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade podman-testsUpgrade python3-podmanUpgrade conmonUpgrade slirp4netnsUpgrade netavark | Apr 25, 2024 | Mar 18, 2024 |
| Redhat Openshift | — | Upgrade podman | May 9, 2024 | Mar 18, 2024 |
| Redhat_linux | — | Upgrade netavarkUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade toolbox-debugsourceUpgrade skopeoUpgrade runcUpgrade podman-testsUpgrade toolbox-testsUpgrade buildahUpgrade aardvark-dnsUpgrade libslirp-debuginfoUpgrade buildah-debugsourceUpgrade podman-catatonit-debuginfoNo solution existsUpgrade podman-remoteUpgrade criu-debuginfoUpgrade critUpgrade conmon-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade criuUpgrade buildah-debuginfoUpgrade podman-catatonitUpgrade toolboxUpgrade podmanUpgrade criu-libs-debuginfoUpgrade udicaUpgrade podman-debuginfoUpgrade podman-dockerUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfsUpgrade conmonUpgrade containers-commonUpgrade buildah-tests-debuginfoUpgrade skopeo-testsUpgrade python3-criuUpgrade criu-libsUpgrade podman-gvproxyUpgrade podman-remote-debuginfoUpgrade criu-debugsourceUpgrade slirp4netnsUpgrade slirp4netns-debugsourceUpgrade crun-debuginfoUpgrade libslirpUpgrade container-selinuxUpgrade runc-debuginfoUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade conmon-debuginfoUpgrade podman-pluginsUpgrade cockpit-podmanUpgrade fuse-overlayfs-debugsourceUpgrade python3-podmanUpgrade toolbox-debuginfoUpgrade libslirp-develUpgrade runc-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-plugins-debuginfoUpgrade libslirp-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade criu-develUpgrade crun | Apr 29, 2024 | Mar 18, 2024 |
| Rocky_linux | — | Upgrade criu-debuginfoUpgrade criuUpgrade conmon-debugsourceUpgrade skopeo-debugsourceUpgrade libslirp-debuginfoUpgrade toolbox-testsUpgrade aardvark-dnsUpgrade runc-debugsourceUpgrade podman-remoteUpgrade buildahUpgrade criu-debugsourceUpgrade podman-catatonitUpgrade buildah-testsUpgrade buildah-tests-debuginfoUpgrade slirp4netnsUpgrade conmon-debuginfoUpgrade podman-gvproxyUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debugsourceUpgrade netavarkUpgrade skopeo-debuginfoUpgrade toolbox-debugsourceUpgrade buildah-debuginfoUpgrade podman-debuginfoUpgrade libslirpUpgrade slirp4netns-debugsourceUpgrade skopeoUpgrade python3-criuUpgrade podman-plugins-debuginfoUpgrade criu-libs-debuginfoUpgrade conmonUpgrade skopeo-testsUpgrade runcUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade podman-debugsourceUpgrade podman-pluginsUpgrade crun-debuginfoUpgrade crunUpgrade toolbox-debuginfoUpgrade runc-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade podman-gvproxy-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-develUpgrade containernetworking-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade criu-libsUpgrade buildah-debugsourceUpgrade podman-testsUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netns-debuginfoUpgrade podmanUpgrade fuse-overlayfs-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade crun-debugsourceUpgrade critUpgrade libslirp-debugsourceUpgrade podman-catatonit-debuginfoUpgrade toolbox | May 8, 2024 | Mar 18, 2024 |
| Suse | — | Upgrade cniUpgrade podman-cni-configUpgrade docker-zsh-completionUpgrade cni-pluginsUpgrade docker-fish-completionUpgrade dockerUpgrade podman-dockerUpgrade podmanUpgrade podmanshUpgrade docker-bash-completionUpgrade podman-remoteUpgrade docker-rootless-extrasUpgrade buildah | Apr 1, 2024 | Mar 18, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 17, 2026 | Mar 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub