A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade container-selinuxUpgrade libslirp-develUpgrade runcUpgrade containers-commonUpgrade aardvark-dnsUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade python3-criuUpgrade podman-remoteUpgrade buildahUpgrade skopeoUpgrade containernetworking-pluginsUpgrade podmanUpgrade podman-gvproxyUpgrade toolbox-testsUpgrade podman-dockerUpgrade libslirpUpgrade criuUpgrade crunUpgrade buildah-testsUpgrade critUpgrade fuse-overlayfsUpgrade conmonUpgrade cockpit-podmanUpgrade podman-catatonitUpgrade criu-develUpgrade toolboxUpgrade python3-podmanUpgrade netavarkUpgrade slirp4netnsUpgrade podman-pluginsUpgrade udicaUpgrade podman-testsUpgrade skopeo-tests | Nov 7, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | Upgrade golang-github-containers-buildah | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade containernetworking-pluginsUpgrade buildahUpgrade podman-pluginsUpgrade skopeoUpgrade podman-catatonitUpgrade runcUpgrade fuse-overlayfsUpgrade critUpgrade podmanUpgrade podman-remoteUpgrade criuUpgrade netavarkUpgrade slirp4netnsUpgrade containers-commonUpgrade skopeo-testsUpgrade podman-gvproxyUpgrade criu-develUpgrade crunUpgrade python3-podmanUpgrade conmonUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade libslirpUpgrade podman-dockerUpgrade libslirp-develUpgrade container-selinuxUpgrade buildah-testsUpgrade cockpit-podmanUpgrade podman-testsUpgrade python3-criu | Nov 11, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade rhcos | Nov 27, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade podman-gvproxyUpgrade podman-pluginsUpgrade udicaUpgrade podman-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade toolboxUpgrade podman-debuginfoUpgrade libslirp-debuginfoUpgrade toolbox-debuginfoUpgrade skopeo-testsUpgrade slirp4netns-debuginfoUpgrade slirp4netns-debugsourceUpgrade skopeoUpgrade conmonUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-testsUpgrade podman-remote-debuginfoUpgrade podman-catatonit-debuginfoUpgrade toolbox-debugsourceUpgrade crunUpgrade runc-debuginfoUpgrade criu-libs-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade libslirpUpgrade container-selinuxUpgrade buildah-debugsourceUpgrade criu-develUpgrade libslirp-develUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-debugsourceUpgrade podman-plugins-debuginfoUpgrade runcUpgrade critUpgrade podman-dockerUpgrade slirp4netnsUpgrade podman-remoteUpgrade conmon-debuginfoUpgrade runc-debugsourceUpgrade crun-debugsourceUpgrade podman-catatonitUpgrade buildah-tests-debuginfoUpgrade podmanUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade buildahUpgrade cockpit-podmanUpgrade criu-debuginfoUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-pluginsUpgrade buildah-debuginfoUpgrade criuUpgrade netavarkUpgrade fuse-overlayfsUpgrade aardvark-dnsUpgrade toolbox-testsUpgrade containers-commonUpgrade crun-debuginfoUpgrade python3-podmanUpgrade conmon-debugsourceUpgrade buildah-testsUpgrade criu-debugsource | Nov 7, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade slirp4netns-debuginfoUpgrade podman-pluginsUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade podman-debugsourceUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade criu-libsUpgrade crun-debuginfoUpgrade slirp4netns-debugsourceUpgrade conmon-debuginfoUpgrade criu-debuginfoUpgrade libslirpUpgrade podman-plugins-debuginfoUpgrade podman-testsUpgrade crun-debugsourceUpgrade runc-debuginfoUpgrade runc-debugsourceUpgrade skopeo-testsUpgrade buildah-tests-debuginfoUpgrade libslirp-develUpgrade podman-gvproxyUpgrade conmonUpgrade containers-commonUpgrade podman-remote-debuginfoUpgrade toolbox-debugsourceUpgrade podman-remoteUpgrade python3-criuUpgrade buildah-debuginfoUpgrade crunUpgrade podmanUpgrade libslirp-debugsourceUpgrade conmon-debugsourceUpgrade criu-debugsourceUpgrade toolbox-testsUpgrade podman-catatonitUpgrade libslirp-debuginfoUpgrade runcUpgrade podman-catatonit-debuginfoUpgrade buildah-testsUpgrade fuse-overlayfs-debuginfoUpgrade netavarkUpgrade podman-gvproxy-debuginfoUpgrade toolbox-debuginfoUpgrade podman-debuginfoUpgrade buildahUpgrade criuUpgrade critUpgrade fuse-overlayfsUpgrade buildah-debugsourceUpgrade toolboxUpgrade skopeoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-libs-debuginfoUpgrade containernetworking-plugins | Nov 19, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade buildahUpgrade govulncheck-vulndbUpgrade podman-dockerUpgrade podmanshUpgrade podmanUpgrade podman-remote | Dec 31, 2024 | Oct 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 2, 2026 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub