A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade skopeo-testsUpgrade podman-pluginsUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade udicaUpgrade libslirpUpgrade podman-testsUpgrade conmonUpgrade podman-dockerUpgrade netavarkUpgrade cockpit-podmanUpgrade buildah-testsUpgrade slirp4netnsUpgrade toolboxUpgrade python3-podmanUpgrade crunUpgrade critUpgrade criuUpgrade podman-catatonitUpgrade toolbox-testsUpgrade criu-develUpgrade buildahUpgrade container-selinuxUpgrade skopeoUpgrade runcUpgrade criu-libsUpgrade python3-criuUpgrade containers-commonUpgrade libslirp-develUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade aardvark-dnsUpgrade podman-remoteUpgrade containernetworking-plugins | Nov 7, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | Upgrade golang-github-containers-buildah | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade criuUpgrade buildahUpgrade containernetworking-pluginsUpgrade skopeoUpgrade critUpgrade fuse-overlayfsUpgrade runcUpgrade podmanUpgrade podman-catatonitUpgrade podman-remoteUpgrade netavarkUpgrade podman-pluginsUpgrade aardvark-dnsUpgrade python3-criuUpgrade cockpit-podmanUpgrade libslirp-develUpgrade podman-dockerUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade container-selinuxUpgrade python3-podmanUpgrade crunUpgrade slirp4netnsUpgrade buildah-testsUpgrade criu-libsUpgrade libslirpUpgrade podman-testsUpgrade podman-gvproxyUpgrade criu-develUpgrade skopeo-testsUpgrade containers-common | Nov 11, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade rhcos | Nov 27, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade netavarkUpgrade criuUpgrade aardvark-dnsUpgrade criu-libsUpgrade fuse-overlayfsUpgrade buildah-debuginfoUpgrade podman-remoteUpgrade toolbox-testsUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade runc-debugsourceUpgrade cockpit-podmanUpgrade criu-debugsourceUpgrade python3-podmanUpgrade buildah-testsUpgrade buildah-tests-debuginfoUpgrade conmon-debuginfoUpgrade podmanUpgrade crun-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonitUpgrade buildahUpgrade crun-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade criu-debuginfoUpgrade conmon-debugsourceUpgrade container-selinuxUpgrade slirp4netns-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade libslirp-develUpgrade slirp4netnsUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmonUpgrade criu-libs-debuginfoUpgrade python3-criuUpgrade skopeoUpgrade podman-pluginsUpgrade runcUpgrade podman-dockerUpgrade podman-plugins-debuginfoUpgrade critUpgrade podman-debugsourceUpgrade buildah-debugsourceUpgrade runc-debuginfoUpgrade toolboxUpgrade podman-testsUpgrade podman-debuginfoUpgrade slirp4netns-debuginfoUpgrade toolbox-debuginfoUpgrade libslirp-debuginfoUpgrade libslirpUpgrade criu-develUpgrade podman-remote-debuginfoUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-catatonit-debuginfoUpgrade libslirp-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade crunUpgrade skopeo-testsUpgrade podman-gvproxyUpgrade udica | Nov 7, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade podman-gvproxy-debuginfoUpgrade buildah-debugsourceUpgrade toolbox-debugsourceUpgrade buildah-testsUpgrade podman-catatonit-debuginfoUpgrade criuUpgrade libslirp-debugsourceUpgrade runcUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfsUpgrade criu-debugsourceUpgrade crunUpgrade libslirp-debuginfoUpgrade podman-catatonitUpgrade toolbox-testsUpgrade critUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolbox-debuginfoUpgrade python3-criuUpgrade criu-libs-debuginfoUpgrade buildahUpgrade podman-debuginfoUpgrade skopeoUpgrade buildah-debuginfoUpgrade conmon-debugsourceUpgrade podmanUpgrade podman-remoteUpgrade toolboxUpgrade netavarkUpgrade runc-debuginfoUpgrade libslirp-develUpgrade libslirpUpgrade podman-gvproxyUpgrade podman-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-develUpgrade conmonUpgrade podman-pluginsUpgrade containers-commonUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade criu-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade slirp4netns-debugsourceUpgrade slirp4netns-debuginfoUpgrade crun-debuginfoUpgrade conmon-debuginfoUpgrade criu-libsUpgrade slirp4netnsUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-plugins-debuginfoUpgrade aardvark-dnsUpgrade crun-debugsourceUpgrade buildah-tests-debuginfoUpgrade skopeo-testsUpgrade runc-debugsource | Nov 19, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade podmanshUpgrade podman-remoteUpgrade podmanUpgrade podman-dockerUpgrade govulncheck-vulndbUpgrade buildah | Dec 31, 2024 | Oct 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 2, 2026 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub