A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade runcUpgrade podmanUpgrade python3-criuUpgrade aardvark-dnsUpgrade podman-testsUpgrade critUpgrade libslirpUpgrade udicaUpgrade slirp4netnsUpgrade crunUpgrade netavarkUpgrade buildah-testsUpgrade cockpit-podmanUpgrade criu-develUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade skopeo-testsUpgrade fuse-overlayfsUpgrade podman-pluginsUpgrade criuUpgrade toolboxUpgrade toolbox-testsUpgrade conmonUpgrade podman-dockerUpgrade python3-podmanUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade container-selinuxUpgrade libslirp-develUpgrade containers-commonUpgrade podman-remoteUpgrade buildahUpgrade containernetworking-pluginsUpgrade skopeo | Nov 7, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade podmanUpgrade buildah | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | Upgrade golang-github-containers-buildahNo solution exists | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade critUpgrade fuse-overlayfsUpgrade podman-pluginsUpgrade skopeoUpgrade podmanUpgrade podman-remoteUpgrade buildahUpgrade criuUpgrade netavarkUpgrade containernetworking-pluginsUpgrade runcUpgrade podman-catatonitUpgrade python3-criuUpgrade cockpit-podmanUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hookUpgrade podman-gvproxyUpgrade libslirp-develUpgrade container-selinuxUpgrade aardvark-dnsUpgrade criu-develUpgrade containers-commonUpgrade crunUpgrade python3-podmanUpgrade buildah-testsUpgrade criu-libsUpgrade slirp4netnsUpgrade podman-testsUpgrade libslirpUpgrade conmonUpgrade podman-docker | Nov 11, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade rhcos | Nov 27, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade podman-testsUpgrade libslirp-debuginfoUpgrade slirp4netns-debuginfoUpgrade buildah-debugsourceUpgrade skopeoUpgrade toolboxUpgrade container-selinuxUpgrade podman-debuginfoUpgrade podman-gvproxyUpgrade criu-develUpgrade libslirp-develUpgrade podman-catatonit-debuginfoUpgrade critUpgrade python3-criuUpgrade crunUpgrade libslirp-debugsourceUpgrade runcUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade runc-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-plugins-debuginfoUpgrade libslirpUpgrade slirp4netnsUpgrade criu-libs-debuginfoUpgrade skopeo-testsUpgrade udicaUpgrade toolbox-debuginfoUpgrade podman-debugsourceUpgrade podman-pluginsUpgrade containernetworking-plugins-debugsourceUpgrade podman-dockerUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade conmonUpgrade netavarkUpgrade containers-commonUpgrade cockpit-podmanUpgrade podman-catatonitUpgrade crun-debuginfoUpgrade criuUpgrade buildah-testsUpgrade toolbox-testsUpgrade containernetworking-pluginsUpgrade buildah-debuginfoUpgrade criu-debugsourceUpgrade python3-podmanUpgrade oci-seccomp-bpf-hookUpgrade podmanUpgrade fuse-overlayfs-debugsourceUpgrade runc-debugsourceUpgrade fuse-overlayfsUpgrade criu-libsUpgrade aardvark-dnsUpgrade criu-debuginfoUpgrade crun-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade buildah-tests-debuginfoUpgrade conmon-debuginfoUpgrade conmon-debugsourceUpgrade buildahUpgrade podman-remote | Nov 7, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade podman-gvproxyUpgrade containers-commonUpgrade buildah-tests-debuginfoUpgrade libslirpUpgrade slirp4netns-debugsourceUpgrade libslirp-develUpgrade podman-plugins-debuginfoUpgrade crun-debugsourceUpgrade criu-debuginfoUpgrade skopeo-testsUpgrade crun-debuginfoUpgrade podman-testsUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade conmon-debuginfoUpgrade runc-debuginfoUpgrade podman-pluginsUpgrade runc-debugsourceUpgrade podman-debugsourceUpgrade criu-develUpgrade podman-remote-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade criu-libsUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildah-debuginfoUpgrade podman-remoteUpgrade fuse-overlayfs-debuginfoUpgrade containernetworking-pluginsUpgrade toolboxUpgrade criu-libs-debuginfoUpgrade python3-criuUpgrade skopeoUpgrade libslirp-debugsourceUpgrade conmon-debugsourceUpgrade podmanUpgrade toolbox-testsUpgrade criuUpgrade critUpgrade buildah-debugsourceUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade netavarkUpgrade libslirp-debuginfoUpgrade crunUpgrade criu-debugsourceUpgrade buildahUpgrade toolbox-debuginfoUpgrade podman-debuginfoUpgrade podman-catatonit-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade buildah-testsUpgrade toolbox-debugsourceUpgrade runc | Nov 19, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade podmanshUpgrade podmanUpgrade podman-remoteUpgrade govulncheck-vulndbUpgrade buildahUpgrade podman-docker | Dec 31, 2024 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub