A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade runcUpgrade oci-seccomp-bpf-hookUpgrade container-selinuxUpgrade aardvark-dnsUpgrade python3-criuUpgrade buildahUpgrade podman-remoteUpgrade skopeoUpgrade containers-commonUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade podmanUpgrade criu-libsUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade toolboxUpgrade netavarkUpgrade podman-gvproxyUpgrade libslirpUpgrade criu-develUpgrade skopeo-testsUpgrade buildah-testsUpgrade podman-testsUpgrade udicaUpgrade podman-pluginsUpgrade critUpgrade conmonUpgrade criuUpgrade toolbox-testsUpgrade slirp4netnsUpgrade python3-podmanUpgrade cockpit-podmanUpgrade crunUpgrade podman-docker | Nov 7, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | No solution existsUpgrade golang-github-containers-buildah | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade podman-catatonitUpgrade criuUpgrade podmanUpgrade podman-remoteUpgrade skopeoUpgrade buildahUpgrade fuse-overlayfsUpgrade runcUpgrade critUpgrade netavarkUpgrade libslirp-develUpgrade container-selinuxUpgrade aardvark-dnsUpgrade python3-criuUpgrade cockpit-podmanUpgrade python3-podmanUpgrade conmonUpgrade podman-gvproxyUpgrade criu-develUpgrade containers-commonUpgrade buildah-testsUpgrade skopeo-testsUpgrade libslirpUpgrade criu-libsUpgrade slirp4netnsUpgrade podman-testsUpgrade crunUpgrade podman-dockerUpgrade oci-seccomp-bpf-hook | Nov 11, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade rhcos | Nov 27, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade buildah-tests-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade podmanUpgrade buildah-testsUpgrade buildah-debuginfoUpgrade podman-remoteUpgrade conmon-debugsourceUpgrade toolbox-testsUpgrade podman-catatonitUpgrade containernetworking-pluginsUpgrade criuUpgrade aardvark-dnsUpgrade netavarkUpgrade criu-libsUpgrade fuse-overlayfsUpgrade python3-podmanUpgrade buildahUpgrade crun-debugsourceUpgrade criu-debuginfoUpgrade cockpit-podmanUpgrade containers-commonUpgrade crun-debuginfoUpgrade conmon-debuginfoUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade runc-debugsourceUpgrade podman-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmonUpgrade libslirp-debuginfoUpgrade skopeo-testsUpgrade containernetworking-plugins-debugsourceUpgrade runc-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade toolboxUpgrade skopeoUpgrade container-selinuxUpgrade podman-testsUpgrade buildah-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-debuginfoUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade python3-criuUpgrade criu-libs-debuginfoUpgrade podman-gvproxyUpgrade containernetworking-plugins-debuginfoUpgrade crunUpgrade criu-develUpgrade libslirp-develUpgrade podman-plugins-debuginfoUpgrade runcUpgrade slirp4netnsUpgrade critUpgrade podman-dockerUpgrade udicaUpgrade podman-catatonit-debuginfoUpgrade toolbox-debugsourceUpgrade libslirpUpgrade libslirp-debugsourceUpgrade podman-remote-debuginfo | Nov 7, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade skopeo-testsUpgrade aardvark-dnsUpgrade podman-remote-debuginfoUpgrade conmonUpgrade podman-plugins-debuginfoUpgrade buildah-tests-debuginfoUpgrade criu-debuginfoUpgrade crun-debugsourceUpgrade criu-libsUpgrade libslirp-develUpgrade runc-debugsourceUpgrade libslirpUpgrade conmon-debuginfoUpgrade crun-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-debugsourceUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade containers-commonUpgrade runc-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-testsUpgrade slirp4netns-debugsourceUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade criu-develUpgrade slirp4netns-debuginfoUpgrade buildah-testsUpgrade critUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolbox-debugsourceUpgrade buildah-debugsourceUpgrade skopeoUpgrade python3-criuUpgrade criu-libs-debuginfoUpgrade containernetworking-pluginsUpgrade toolbox-testsUpgrade libslirp-debuginfoUpgrade podman-catatonitUpgrade crunUpgrade toolbox-debuginfoUpgrade podman-debuginfoUpgrade buildahUpgrade podman-gvproxy-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonit-debuginfoUpgrade runcUpgrade criu-debugsourceUpgrade netavarkUpgrade podman-remoteUpgrade podmanUpgrade libslirp-debugsourceUpgrade conmon-debugsourceUpgrade buildah-debuginfoUpgrade toolboxUpgrade fuse-overlayfsUpgrade criu | Nov 19, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade podmanshUpgrade podmanUpgrade podman-remoteUpgrade podman-dockerUpgrade govulncheck-vulndbUpgrade buildah | Dec 31, 2024 | Oct 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 2, 2026 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub