A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade aardvark-dnsUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade skopeoUpgrade podman-remoteUpgrade libslirp-develUpgrade container-selinuxUpgrade buildahUpgrade containers-commonUpgrade podmanUpgrade runcUpgrade libslirpUpgrade toolbox-testsUpgrade fuse-overlayfsUpgrade buildah-testsUpgrade podman-dockerUpgrade crunUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade critUpgrade criuUpgrade conmonUpgrade podman-pluginsUpgrade udicaUpgrade podman-catatonitUpgrade toolboxUpgrade slirp4netnsUpgrade podman-testsUpgrade criu-develUpgrade skopeo-testsUpgrade python3-podmanUpgrade netavark | Nov 7, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade podmanUpgrade buildah | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | No solution existsUpgrade golang-github-containers-buildah | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade podman-dockerUpgrade libslirp-develUpgrade crunUpgrade conmonUpgrade container-selinuxUpgrade containers-commonUpgrade cockpit-podmanUpgrade python3-criuUpgrade python3-podmanUpgrade skopeo-testsUpgrade criu-libsUpgrade libslirpUpgrade podman-testsUpgrade podman-gvproxyUpgrade buildah-testsUpgrade slirp4netnsUpgrade aardvark-dnsUpgrade skopeoUpgrade containernetworking-pluginsUpgrade podman-pluginsUpgrade netavarkUpgrade criuUpgrade podman-remoteUpgrade podmanUpgrade buildahUpgrade podman-catatonitUpgrade runcUpgrade fuse-overlayfsUpgrade crit | Nov 11, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade rhcos | Nov 27, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade podman-remoteUpgrade buildah-tests-debuginfoUpgrade toolbox-testsUpgrade crun-debuginfoUpgrade python3-podmanUpgrade cockpit-podmanUpgrade criuUpgrade aardvark-dnsUpgrade criu-debugsourceUpgrade conmon-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debuginfoUpgrade containernetworking-pluginsUpgrade criu-libsUpgrade fuse-overlayfsUpgrade netavarkUpgrade conmon-debugsourceUpgrade buildahUpgrade fuse-overlayfs-debuginfoUpgrade podmanUpgrade buildah-testsUpgrade podman-catatonitUpgrade criu-debuginfoUpgrade containers-commonUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade runc-debugsourceUpgrade slirp4netnsUpgrade podman-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade toolboxUpgrade critUpgrade libslirp-debuginfoUpgrade slirp4netns-debuginfoUpgrade toolbox-debuginfoUpgrade podman-pluginsUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-testsUpgrade podman-debugsourceUpgrade podman-gvproxyUpgrade slirp4netns-debugsourceUpgrade python3-criuUpgrade conmonUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-libs-debuginfoUpgrade runcUpgrade skopeoUpgrade podman-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-dockerUpgrade toolbox-debugsourceUpgrade crunUpgrade udicaUpgrade podman-catatonit-debuginfoUpgrade criu-develUpgrade libslirp-develUpgrade podman-gvproxy-debuginfoUpgrade libslirpUpgrade runc-debuginfoUpgrade container-selinuxUpgrade buildah-debugsourceUpgrade libslirp-debugsource | Nov 7, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade podman-debuginfoUpgrade toolboxUpgrade containernetworking-pluginsUpgrade toolbox-debuginfoUpgrade buildahUpgrade fuse-overlayfs-debuginfoUpgrade toolbox-debugsourceUpgrade podman-catatonit-debuginfoUpgrade buildah-testsUpgrade podman-gvproxy-debuginfoUpgrade criu-libs-debuginfoUpgrade runcUpgrade netavarkUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade python3-criuUpgrade skopeoUpgrade criu-debugsourceUpgrade podmanUpgrade criuUpgrade buildah-debuginfoUpgrade critUpgrade conmon-debugsourceUpgrade toolbox-testsUpgrade fuse-overlayfsUpgrade buildah-debugsourceUpgrade podman-remoteUpgrade libslirp-debuginfoUpgrade podman-catatonitUpgrade crunUpgrade libslirp-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-testsUpgrade libslirp-develUpgrade podman-gvproxyUpgrade libslirpUpgrade runc-debuginfoUpgrade skopeo-testsUpgrade criu-debuginfoUpgrade runc-debugsourceUpgrade criu-develUpgrade podman-pluginsUpgrade podman-debugsourceUpgrade criu-libsUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-plugins-debuginfoUpgrade aardvark-dnsUpgrade crun-debugsourceUpgrade buildah-tests-debuginfoUpgrade slirp4netns-debuginfoUpgrade crun-debuginfoUpgrade conmon-debuginfoUpgrade podman-remote-debuginfoUpgrade containers-commonUpgrade conmonUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade slirp4netns-debugsource | Nov 19, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade buildahUpgrade podman-dockerUpgrade govulncheck-vulndbUpgrade podmanUpgrade podman-remoteUpgrade podmansh | Dec 31, 2024 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub