--- id: "CVE-2024-9675" kind: "vulnerability" aliases: ["CVE-2024-9675", "GHSA-586p-749j-fhwp"] title: "Buildah allows arbitrary directory mount" severity: "high" cvss: 7.8 epss: 0.00392 exploited: false status: "open" category: "package" products: [{"name": "github.com/containers/buildah", "fixed": ["1.38.0"], "affected": "< 1.38.0", "ecosystem": "go"}, {"name": "buildah project buildah", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": [], "affected": "= 4.13", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": [], "affected": "= 4.14", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": [], "affected": "= 4.15", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": [], "affected": "= 4.16", "ecosystem": "vendor"}, {"name": "redhat openshift container platform", "fixed": [], "affected": "= 4.17", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux eus", "fixed": [], "affected": "= 8.8", "ecosystem": "vendor"}, {"name": "redhat enterprise linux eus", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux eus", "fixed": [], "affected": "= 9.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux eus", "fixed": [], "affected": "= 9.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for arm 64", "fixed": [], "affected": "= 8.0_aarch64", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for arm 64", "fixed": [], "affected": "= 9.0_aarch64", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for arm 64 eus", "fixed": [], "affected": "= 8.8_aarch64", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for arm 64 eus", "fixed": [], "affected": "= 9.0_aarch64", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for arm 64 eus", "fixed": [], "affected": "= 9.2_aarch64", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for arm 64 eus", "fixed": [], "affected": "= 9.4_aarch64", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for ibm z systems", "fixed": [], "affected": "= 8.0_s390x", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for ibm z systems", "fixed": [], "affected": "= 9.0_s390x", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for ibm z systems eus", "fixed": [], "affected": "= 8.8_s390x", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for ibm z systems eus", "fixed": [], "affected": "= 9.0_s390x", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for ibm z systems eus", "fixed": [], "affected": "= 9.2_s390x", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for ibm z systems eus", "fixed": [], "affected": "= 9.4_s390x", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for power little endian", "fixed": [], "affected": "= 8.0_ppc64le", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for power little endian", "fixed": [], "affected": "= 9.0_ppc64le", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for power little endian eus", "fixed": [], "affected": "= 8.8_ppc64le", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for power little endian eus", "fixed": [], "affected": "= 9.0_ppc64le", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for power little endian eus", "fixed": [], "affected": "= 9.2_ppc64le", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for power little endian eus", "fixed": [], "affected": "= 9.4_ppc64le", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server aus", "fixed": [], "affected": "= 8.6", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server aus", "fixed": [], "affected": "= 9.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server aus", "fixed": [], "affected": "= 9.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server for power little endian update services for sap solutions", "fixed": [], "affected": "= 8.6_ppc64le", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server for power little endian update services for sap solutions", "fixed": [], "affected": "= 8.8_ppc64le", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server for power little endian update services for sap solutions", "fixed": [], "affected": "= 9.0_ppc64le", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server for power little endian update services for sap solutions", "fixed": [], "affected": "= 9.2_ppc64le", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server for power little endian update services for sap solutions", "fixed": [], "affected": "= 9.4_ppc64le", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server tus", "fixed": [], "affected": "= 8.6", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server tus", "fixed": [], "affected": "= 8.8", "ecosystem": "vendor"}] ecosystems: ["go", "vendor"] tags: ["buildah", "ci", "containers", "cwe-22", "go", "package"] not_affected_if: ["isolated-build-runners", "trusted-containerfiles-only"] published_at: "2024-10-09T15:15:17+00:00" first_seen_at: "2026-10-30T18:35:23+00:00" updated_at: "2026-10-30T18:55:30+00:00" sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-586p-749j-fhwp", "first_seen_at": "2026-10-30T18:35:23+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9675", "first_seen_at": "2026-10-30T18:55:30+00:00"}] --- # Buildah allows arbitrary directory mount Buildah does not check that user-specified cache mount paths stay inside the cache directory. A RUN instruction in a Containerfile can mount any host directory the Buildah user can access, read and write, into the container. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - go:github.com/containers/buildah affected < 1.38.0 fixed 1.38.0 - vendor:buildah project buildah affected ? fixed ? - vendor:redhat openshift container platform affected = 4.13 fixed ? - vendor:redhat openshift container platform affected = 4.14 fixed ? - vendor:redhat openshift container platform affected = 4.15 fixed ? - vendor:redhat openshift container platform affected = 4.16 fixed ? - vendor:redhat openshift container platform affected = 4.17 fixed ? - vendor:redhat enterprise linux affected = 8.0 fixed ? - vendor:redhat enterprise linux affected = 9.0 fixed ? - vendor:redhat enterprise linux eus affected = 8.8 fixed ? - vendor:redhat enterprise linux eus affected = 9.0 fixed ? - vendor:redhat enterprise linux eus affected = 9.2 fixed ? - vendor:redhat enterprise linux eus affected = 9.4 fixed ? - vendor:redhat enterprise linux for arm 64 affected = 8.0_aarch64 fixed ? - vendor:redhat enterprise linux for arm 64 affected = 9.0_aarch64 fixed ? - vendor:redhat enterprise linux for arm 64 eus affected = 8.8_aarch64 fixed ? - vendor:redhat enterprise linux for arm 64 eus affected = 9.0_aarch64 fixed ? - vendor:redhat enterprise linux for arm 64 eus affected = 9.2_aarch64 fixed ? - vendor:redhat enterprise linux for arm 64 eus affected = 9.4_aarch64 fixed ? - vendor:redhat enterprise linux for ibm z systems affected = 8.0_s390x fixed ? - vendor:redhat enterprise linux for ibm z systems affected = 9.0_s390x fixed ? - vendor:redhat enterprise linux for ibm z systems eus affected = 8.8_s390x fixed ? - vendor:redhat enterprise linux for ibm z systems eus affected = 9.0_s390x fixed ? - vendor:redhat enterprise linux for ibm z systems eus affected = 9.2_s390x fixed ? - vendor:redhat enterprise linux for ibm z systems eus affected = 9.4_s390x fixed ? - vendor:redhat enterprise linux for power little endian affected = 8.0_ppc64le fixed ? - vendor:redhat enterprise linux for power little endian affected = 9.0_ppc64le fixed ? - vendor:redhat enterprise linux for power little endian eus affected = 8.8_ppc64le fixed ? - vendor:redhat enterprise linux for power little endian eus affected = 9.0_ppc64le fixed ? - vendor:redhat enterprise linux for power little endian eus affected = 9.2_ppc64le fixed ? - vendor:redhat enterprise linux for power little endian eus affected = 9.4_ppc64le fixed ? - vendor:redhat enterprise linux server aus affected = 8.6 fixed ? - vendor:redhat enterprise linux server aus affected = 9.2 fixed ? - vendor:redhat enterprise linux server aus affected = 9.4 fixed ? - vendor:redhat enterprise linux server for power little endian update services for sap solutions affected = 8.6_ppc64le fixed ? - vendor:redhat enterprise linux server for power little endian update services for sap solutions affected = 8.8_ppc64le fixed ? - vendor:redhat enterprise linux server for power little endian update services for sap solutions affected = 9.0_ppc64le fixed ? - vendor:redhat enterprise linux server for power little endian update services for sap solutions affected = 9.2_ppc64le fixed ? - vendor:redhat enterprise linux server for power little endian update services for sap solutions affected = 9.4_ppc64le fixed ? - vendor:redhat enterprise linux server tus affected = 8.6 fixed ? - vendor:redhat enterprise linux server tus affected = 8.8 fixed ? ## How to check - Check the Buildah version with `buildah --version` or the Go module version of `github.com/containers/buildah` in go.mod - Look for Containerfiles that use `RUN --mount=type=cache` with paths you did not write yourself ## Fix - `github.com/containers/buildah` `1.38.0` ## Timeline - 2026-10-30T18:35:23+00:00 ghsa https://github.com/advisories/GHSA-586p-749j-fhwp - 2026-10-30T18:55:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-9675 ## Documents - [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2024:8563 - [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2024:8675 - [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2024:8679 - [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2024:8686 - [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2024:8690 - [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2024:8700 - [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2024:8703 - [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2024:8707 - [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2024:8708 - [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2024:8709 - [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2024:8846 - [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2024:8984 - [fix] Patch: github.com https://github.com/containers/buildah/commit/aa67e5d71ee7ec07122a210baa3b13966a9e086c ## From the sources A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_