A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade criu-libsUpgrade containers-commonUpgrade aardvark-dnsUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade podman-remoteUpgrade podmanUpgrade container-selinuxUpgrade runcUpgrade skopeoUpgrade libslirp-develUpgrade conmonUpgrade criu-develUpgrade podman-testsUpgrade criuUpgrade podman-catatonitUpgrade podman-dockerUpgrade podman-pluginsUpgrade crunUpgrade udicaUpgrade buildah-testsUpgrade cockpit-podmanUpgrade toolbox-testsUpgrade netavarkUpgrade slirp4netnsUpgrade python3-podmanUpgrade podman-gvproxyUpgrade skopeo-testsUpgrade toolboxUpgrade fuse-overlayfsUpgrade critUpgrade libslirp | Nov 7, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | Upgrade golang-github-containers-buildah | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade slirp4netnsUpgrade python3-podmanUpgrade crunUpgrade buildah-testsUpgrade podman-testsUpgrade criu-develUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade cockpit-podmanUpgrade python3-criuUpgrade conmonUpgrade podman-dockerUpgrade aardvark-dnsUpgrade container-selinuxUpgrade podman-gvproxyUpgrade libslirp-develUpgrade libslirpUpgrade criu-libsUpgrade skopeo-testsUpgrade podman-catatonitUpgrade podman-remoteUpgrade podmanUpgrade containernetworking-pluginsUpgrade netavarkUpgrade criuUpgrade critUpgrade fuse-overlayfsUpgrade skopeoUpgrade runcUpgrade podman-pluginsUpgrade buildah | Nov 11, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Nov 27, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade fuse-overlayfs-debugsourceUpgrade podmanUpgrade podman-catatonitUpgrade buildahUpgrade buildah-tests-debuginfoUpgrade crun-debugsourceUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade toolbox-testsUpgrade conmon-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade conmon-debuginfoUpgrade criu-debuginfoUpgrade python3-podmanUpgrade criu-debugsourceUpgrade buildah-debuginfoUpgrade crun-debuginfoUpgrade buildah-testsUpgrade netavarkUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade criu-libsUpgrade criuUpgrade containers-commonUpgrade cockpit-podmanUpgrade oci-seccomp-bpf-hookUpgrade runc-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-pluginsUpgrade toolboxUpgrade toolbox-debugsourceUpgrade skopeo-testsUpgrade slirp4netns-debugsourceUpgrade podman-gvproxyUpgrade podman-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-debugsourceUpgrade podman-remote-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-testsUpgrade container-selinuxUpgrade skopeoUpgrade buildah-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade podman-catatonit-debuginfoUpgrade libslirp-develUpgrade udicaUpgrade criu-develUpgrade libslirpUpgrade podman-plugins-debuginfoUpgrade slirp4netnsUpgrade critUpgrade runcUpgrade podman-dockerUpgrade podman-debuginfoUpgrade libslirp-debuginfoUpgrade toolbox-debuginfoUpgrade python3-criuUpgrade conmonUpgrade slirp4netns-debuginfoUpgrade criu-libs-debuginfoUpgrade runc-debuginfoUpgrade crun | Nov 7, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade criu-libsUpgrade crun-debuginfoUpgrade slirp4netns-debuginfoUpgrade conmon-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade podman-debugsourceUpgrade slirp4netnsUpgrade aardvark-dnsUpgrade containers-commonUpgrade criu-develUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-pluginsUpgrade podman-testsUpgrade runc-debugsourceUpgrade skopeo-testsUpgrade podman-gvproxyUpgrade buildah-tests-debuginfoUpgrade slirp4netns-debugsourceUpgrade libslirpUpgrade crun-debugsourceUpgrade libslirp-develUpgrade podman-remote-debuginfoUpgrade conmonUpgrade criu-debuginfoUpgrade podman-plugins-debuginfoUpgrade runc-debuginfoUpgrade conmon-debugsourceUpgrade toolboxUpgrade skopeoUpgrade python3-criuUpgrade criu-libs-debuginfoUpgrade containernetworking-pluginsUpgrade buildah-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade podman-debuginfoUpgrade toolbox-debuginfoUpgrade buildahUpgrade podman-catatonitUpgrade netavarkUpgrade libslirp-debuginfoUpgrade crunUpgrade criu-debugsourceUpgrade toolbox-testsUpgrade fuse-overlayfs-debuginfoUpgrade buildah-testsUpgrade podman-catatonit-debuginfoUpgrade toolbox-debugsourceUpgrade runcUpgrade criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade critUpgrade fuse-overlayfsUpgrade buildah-debuginfoUpgrade podman-remoteUpgrade podmanUpgrade libslirp-debugsource | Nov 19, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade podman-dockerUpgrade govulncheck-vulndbUpgrade buildahUpgrade podmanshUpgrade podmanUpgrade podman-remote | Dec 31, 2024 | Oct 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 2, 2026 | Oct 1, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub