A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade container-selinuxUpgrade buildahUpgrade containernetworking-pluginsUpgrade libslirp-develUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade aardvark-dnsUpgrade criu-libsUpgrade containers-commonUpgrade runcUpgrade podmanUpgrade skopeoUpgrade podman-remoteUpgrade udicaUpgrade criu-develUpgrade podman-gvproxyUpgrade podman-dockerUpgrade podman-pluginsUpgrade criuUpgrade crunUpgrade podman-testsUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade libslirpUpgrade buildah-testsUpgrade skopeo-testsUpgrade toolboxUpgrade toolbox-testsUpgrade netavarkUpgrade slirp4netnsUpgrade conmonUpgrade critUpgrade cockpit-podmanUpgrade python3-podman | Nov 7, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | No solution existsUpgrade golang-github-containers-buildah | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade podman-pluginsUpgrade podmanUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade critUpgrade buildahUpgrade runcUpgrade criuUpgrade netavarkUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade skopeoUpgrade python3-podmanUpgrade libslirp-develUpgrade libslirpUpgrade criu-libsUpgrade crunUpgrade buildah-testsUpgrade containers-commonUpgrade criu-develUpgrade skopeo-testsUpgrade podman-gvproxyUpgrade python3-criuUpgrade cockpit-podmanUpgrade podman-testsUpgrade slirp4netnsUpgrade podman-dockerUpgrade aardvark-dnsUpgrade container-selinuxUpgrade conmonUpgrade oci-seccomp-bpf-hook | Nov 11, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade rhcos | Nov 27, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade buildah-debugsourceUpgrade slirp4netns-debuginfoUpgrade libslirp-debuginfoUpgrade podman-testsUpgrade skopeoUpgrade udicaUpgrade container-selinuxUpgrade libslirp-develUpgrade toolboxUpgrade podman-debuginfoUpgrade criu-develUpgrade runc-debuginfoUpgrade skopeo-testsUpgrade podman-remote-debuginfoUpgrade podman-gvproxyUpgrade toolbox-debugsourceUpgrade podman-debugsourceUpgrade podman-catatonit-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade critUpgrade conmonUpgrade podman-pluginsUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade libslirpUpgrade criu-libs-debuginfoUpgrade podman-dockerUpgrade libslirp-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crunUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade toolbox-debuginfoUpgrade slirp4netnsUpgrade runcUpgrade conmon-debuginfoUpgrade podmanUpgrade fuse-overlayfs-debuginfoUpgrade criu-debugsourceUpgrade python3-podmanUpgrade buildah-testsUpgrade buildah-debuginfoUpgrade buildah-tests-debuginfoUpgrade buildahUpgrade conmon-debugsourceUpgrade podman-catatonitUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade toolbox-testsUpgrade podman-remoteUpgrade crun-debuginfoUpgrade criu-debuginfoUpgrade fuse-overlayfsUpgrade netavarkUpgrade criu-libsUpgrade criuUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsourceUpgrade runc-debugsourceUpgrade cockpit-podmanUpgrade crun-debugsource | Nov 7, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade runc-debugsourceUpgrade skopeo-testsUpgrade podman-gvproxyUpgrade runc-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade buildah-tests-debuginfoUpgrade crun-debugsourceUpgrade slirp4netns-debugsourceUpgrade libslirpUpgrade podman-plugins-debuginfoUpgrade libslirp-develUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade podman-debugsourceUpgrade criu-libsUpgrade slirp4netnsUpgrade crun-debuginfoUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade podman-testsUpgrade fuse-overlayfs-debugsourceUpgrade aardvark-dnsUpgrade conmon-debuginfoUpgrade criu-debuginfoUpgrade conmonUpgrade containers-commonUpgrade criu-develUpgrade podman-pluginsUpgrade criu-libs-debuginfoUpgrade buildah-testsUpgrade podman-catatonitUpgrade podman-gvproxy-debuginfoUpgrade podman-catatonit-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade netavarkUpgrade libslirp-debuginfoUpgrade crunUpgrade criu-debugsourceUpgrade toolbox-debugsourceUpgrade runcUpgrade toolbox-testsUpgrade buildah-debugsourceUpgrade toolbox-debuginfoUpgrade podman-debuginfoUpgrade buildahUpgrade podmanUpgrade fuse-overlayfsUpgrade criuUpgrade critUpgrade buildah-debuginfoUpgrade podman-remoteUpgrade libslirp-debugsourceUpgrade conmon-debugsourceUpgrade skopeoUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-pluginsUpgrade toolbox | Nov 19, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade podman-remoteUpgrade podmanUpgrade podmanshUpgrade podman-dockerUpgrade buildahUpgrade govulncheck-vulndb | Dec 31, 2024 | Oct 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 2, 2026 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub