Live › vulnerability › CVE-2024-9675
Buildah does not check that user-specified cache mount paths stay inside the cache directory. A RUN instruction in a Containerfile can mount any host directory the Buildah user can access, read and write, into the container.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:35 UTC, 0h before NVD. All times on this page are UTC.
Teams that build container images with Buildah, especially from Containerfiles they do not fully control, such as third-party or untrusted pull requests. Build pipelines running Buildah as a user with access to sensitive host directories are the most exposed. Teams that only run builds from trusted, self-written Containerfiles on isolated runners have less exposure.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/containers/buildah | go | < 1.38.0 | 1.38.0 |
| buildah project buildah | vendor | – | – |
| redhat openshift container platform | vendor | = 4.13 | – |
| redhat openshift container platform | vendor | = 4.14 | – |
| redhat openshift container platform | vendor | = 4.15 | – |
| redhat openshift container platform | vendor | = 4.16 | – |
| redhat openshift container platform | vendor | = 4.17 | – |
| redhat enterprise linux |
| vendor |
| = 8.0 |
| – |
| redhat enterprise linux | vendor | = 9.0 | – |
| redhat enterprise linux eus | vendor | = 8.8 | – |
| redhat enterprise linux eus | vendor | = 9.0 | – |
| redhat enterprise linux eus | vendor | = 9.2 | – |
| redhat enterprise linux eus | vendor | = 9.4 | – |
| redhat enterprise linux for arm 64 | vendor | = 8.0_aarch64 | – |
| redhat enterprise linux for arm 64 | vendor | = 9.0_aarch64 | – |
| redhat enterprise linux for arm 64 eus | vendor | = 8.8_aarch64 | – |
| redhat enterprise linux for arm 64 eus | vendor | = 9.0_aarch64 | – |
| redhat enterprise linux for arm 64 eus | vendor | = 9.2_aarch64 | – |
| redhat enterprise linux for arm 64 eus | vendor | = 9.4_aarch64 | – |
| redhat enterprise linux for ibm z systems | vendor | = 8.0_s390x | – |
| redhat enterprise linux for ibm z systems | vendor | = 9.0_s390x | – |
| redhat enterprise linux for ibm z systems eus | vendor | = 8.8_s390x | – |
| redhat enterprise linux for ibm z systems eus | vendor | = 9.0_s390x | – |
| redhat enterprise linux for ibm z systems eus | vendor | = 9.2_s390x | – |
| redhat enterprise linux for ibm z systems eus | vendor | = 9.4_s390x | – |
| redhat enterprise linux for power little endian | vendor | = 8.0_ppc64le | – |
| redhat enterprise linux for power little endian | vendor | = 9.0_ppc64le | – |
| redhat enterprise linux for power little endian eus | vendor | = 8.8_ppc64le | – |
| redhat enterprise linux for power little endian eus | vendor | = 9.0_ppc64le | – |
| redhat enterprise linux for power little endian eus | vendor | = 9.2_ppc64le | – |
| redhat enterprise linux for power little endian eus | vendor | = 9.4_ppc64le | – |
| redhat enterprise linux server aus | vendor | = 8.6 | – |
| redhat enterprise linux server aus | vendor | = 9.2 | – |
| redhat enterprise linux server aus | vendor | = 9.4 | – |
| redhat enterprise linux server for power little endian update services for sap solutions | vendor | = 8.6_ppc64le | – |
| redhat enterprise linux server for power little endian update services for sap solutions | vendor | = 8.8_ppc64le | – |
| redhat enterprise linux server for power little endian update services for sap solutions | vendor | = 9.0_ppc64le | – |
| redhat enterprise linux server for power little endian update services for sap solutions | vendor | = 9.2_ppc64le | – |
| redhat enterprise linux server for power little endian update services for sap solutions | vendor | = 9.4_ppc64le | – |
| redhat enterprise linux server tus | vendor | = 8.6 | – |
| redhat enterprise linux server tus | vendor | = 8.8 | – |
buildah --version or the Go module version of github.com/containers/buildah in go.modRUN --mount=type=cache with paths you did not write yourselfgithub.com/containers/buildah 1.38.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.
This page as .md · .json · in your agent: get_signal("CVE-2024-9675")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.