Description
A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- buildah_project / buildah
- RedHat / enterprise_linux9.0 – 9.0
- RedHat / enterprise_linux8.0 – 8.0
- RedHat / enterprise_linux_eus8.8 – 8.8
- RedHat / enterprise_linux_eus9.2 – 9.2
- RedHat / enterprise_linux_eus9.4 – 9.4
- RedHat / enterprise_linux_eus9.0 – 9.0
- RedHat / enterprise_linux_for_arm_648.0_aarch64 – 8.0_aarch64
- RedHat / enterprise_linux_for_arm_649.0_aarch64 – 9.0_aarch64
- RedHat / enterprise_linux_for_arm_64_eus8.8_aarch64 – 8.8_aarch64
- RedHat / enterprise_linux_for_arm_64_eus9.4_aarch64 – 9.4_aarch64
- RedHat / enterprise_linux_for_arm_64_eus9.2_aarch64 – 9.2_aarch64
- RedHat / enterprise_linux_for_arm_64_eus9.0_aarch64 – 9.0_aarch64
- RedHat / enterprise_linux_for_ibm_z_systems9.0_s390x – 9.0_s390x
- RedHat / enterprise_linux_for_ibm_z_systems8.0_s390x – 8.0_s390x
- RedHat / enterprise_linux_for_ibm_z_systems_eus9.2_s390x – 9.2_s390x
- RedHat / enterprise_linux_for_ibm_z_systems_eus8.8_s390x – 8.8_s390x
- RedHat / enterprise_linux_for_ibm_z_systems_eus9.0_s390x – 9.0_s390x
- RedHat / enterprise_linux_for_ibm_z_systems_eus9.4_s390x – 9.4_s390x
- RedHat / enterprise_linux_for_power_little_endian9.0_ppc64le – 9.0_ppc64le
- RedHat / enterprise_linux_for_power_little_endian8.0_ppc64le – 8.0_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus9.4_ppc64le – 9.4_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus9.2_ppc64le – 9.2_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus9.0_ppc64le – 9.0_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus8.8_ppc64le – 8.8_ppc64le
- RedHat / enterprise_linux_server_aus9.4 – 9.4
- RedHat / enterprise_linux_server_aus8.6 – 8.6
- RedHat / enterprise_linux_server_aus9.2 – 9.2
- RedHat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions9.2_ppc64le – 9.2_ppc64le
- RedHat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions9.4_ppc64le – 9.4_ppc64le
- RedHat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions8.6_ppc64le – 8.6_ppc64le
- RedHat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions8.8_ppc64le – 8.8_ppc64le
- RedHat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions9.0_ppc64le – 9.0_ppc64le
- RedHat / enterprise_linux_server_tus8.8 – 8.8
- RedHat / enterprise_linux_server_tus8.6 – 8.6
- RedHat / enterprise_linux_update_services_for_sap_solutions9.0 – 9.0
- RedHat / enterprise_linux_update_services_for_sap_solutions9.2 – 9.2
- RedHat / enterprise_linux_update_services_for_sap_solutions8.8 – 8.8
- RedHat / enterprise_linux_update_services_for_sap_solutions8.6 – 8.6
- RedHat / enterprise_linux_update_services_for_sap_solutions9.4 – 9.4
- RedHat / openshift_container_platform4.15 – 4.15
- RedHat / openshift_container_platform4.13 – 4.13
- RedHat / openshift_container_platform4.17 – 4.17
- RedHat / openshift_container_platform4.16 – 4.16
- RedHat / openshift_container_platform4.14 – 4.14
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHBA-2024:10967
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8563
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8675
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8679
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8686
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8690
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8700
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8703
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8707
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8708
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8709
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8846
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8984
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8994
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:9051
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:9454
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:9459
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:2445
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:2449
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:2454
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:2701
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:2710
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:3301
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:3573
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2024-9675
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2317458
Updated 18m ago · 8 sources