Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile
Affects buildah builds using --jobs=2 in releases before 1.33.12, from 1.35.0 to before 1.35.5, from 1.37.0 to before 1.37.6, and 1.38.0. Fixed in 1.33.12, 1.35.5, 1.37.6 and 1.38.1.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 1.33.12, 1.35.5, 1.37.6, 1.38.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- buildah
fixed in 1.33.12; From 1.35.0 · fixed in 1.35.5; From 1.37.0 · fixed in 1.37.6; From 1.38.0 · fixed in 1.38.1
- container-tools:rhel8
Version range not reported
- container-tools:rhel8
Version range not reported
- container-tools:rhel8
Version range not reported
- container-tools:rhel8
Version range not reported
- container-tools:rhel8
Version range not reported
- podman
Version range not reported
- buildah
Version range not reported
- podman
Version range not reported
- buildah
Version range not reported
- buildah
Version range not reported
- podman
Version range not reported
- buildah
Version range not reported
- podman
Version range not reported
- openshift/ose-rhel-coreos-8
Version range not reported
- podman
Version range not reported
- buildah
Version range not reported
- podman
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- podman
Version range not reported
- buildah
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- podman
Version range not reported
- buildah
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- podman
Version range not reported
- buildah
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- podman
Version range not reported
- buildah
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- buildah
Version range not reported
- conmon
Version range not reported
- conmon-rs
Version range not reported
- containers-common
Version range not reported
- container-selinux
Version range not reported
- cri-o
Version range not reported
- cri-tools
Version range not reported
- crudini
Version range not reported
- crun
Version range not reported
- golang-github-prometheus-promu
Version range not reported
- haproxy
Version range not reported
- ignition
Version range not reported
- kernel
Version range not reported
- libreswan
Version range not reported
- openshift
Version range not reported
- openshift4-aws-iso
Version range not reported
- openshift-ansible
Version range not reported
- openshift-clients
Version range not reported
- ose-aws-ecr-image-credential-provider
Version range not reported
- ose-azure-acr-image-credential-provider
Version range not reported
- ose-gcp-gcr-image-credential-provider
Version range not reported
- ovn24.09
Version range not reported
- podman
Version range not reported
- pyOpenSSL
Version range not reported
- pysnmp
Version range not reported
- pysnmp-lextudio
Version range not reported
- python-alembic
Version range not reported
- python-amqp
Version range not reported
- python-automaton
Version range not reported
- python-autopage
Version range not reported
- python-bcrypt
Version range not reported
- python-beautifulsoup4
Version range not reported
- python-binary-memcached
Version range not reported
- python-cachetools
Version range not reported
- python-cinderclient
Version range not reported
- python-click
Version range not reported
- python-cliff
Version range not reported
- python-cmd2
Version range not reported
- python-colorama
Version range not reported
- python-construct
Version range not reported
- python-contextlib2
Version range not reported
- python-ddt
Version range not reported
- python-debtcollector
Version range not reported
- python-decorator
Version range not reported
- python-defusedxml
Version range not reported
- python-dogpile-cache
Version range not reported
- python-dracclient
Version range not reported
- python-editor
Version range not reported
- python-eventlet
Version range not reported
- python-fasteners
Version range not reported
- python-fixtures
Version range not reported
- python-flask
Version range not reported
- python-funcsigs
Version range not reported
- python-futurist
Version range not reported
- python-gevent
Version range not reported
- python-glanceclient
Version range not reported
- python-greenlet
Version range not reported
- python-gunicorn
Version range not reported
- python-hardware
Version range not reported
- python-html5lib
Version range not reported
- python-ifaddr
Version range not reported
- python-importlib-metadata
Version range not reported
- python-ironicclient
Version range not reported
- python-ironic-prometheus-exporter
Version range not reported
- python-iso8601
Version range not reported
- python-itsdangerous
Version range not reported
- python-jinja2
Version range not reported
- python-jsonpath-rw
Version range not reported
- python-jsonschema
Version range not reported
- python-kazoo
Version range not reported
- python-keyring
Version range not reported
- python-keystoneauth1
Version range not reported
- python-keystoneclient
Version range not reported
- python-keystonemiddleware
Version range not reported
- python-kombu
Version range not reported
- python-logutils
Version range not reported
- python-markupsafe
Version range not reported
- python-memcached
Version range not reported
- python-microversion-parse
Version range not reported
- python-migrate
Version range not reported
- python-msgpack
Version range not reported
- python-munch
Version range not reported
- python-netaddr
Version range not reported
- python-neutronclient
Version range not reported
- python-openstacksdk
Version range not reported
- python-osc-lib
Version range not reported
- python-os-client-config
Version range not reported
- python-oslo-cache
Version range not reported
- python-oslo-concurrency
Version range not reported
- python-oslo-config
Version range not reported
- python-oslo-context
Version range not reported
- python-oslo-db
Version range not reported
- python-oslo-i18n
Version range not reported
- python-oslo-log
Version range not reported
- python-oslo-messaging
Version range not reported
- python-oslo-metrics
Version range not reported
- python-oslo-middleware
Version range not reported
- python-oslo-policy
Version range not reported
- python-oslo-reports
Version range not reported
- python-oslo-rootwrap
Version range not reported
- python-oslo-serialization
Version range not reported
- python-oslo-service
Version range not reported
- python-oslo-upgradecheck
Version range not reported
- python-oslo-utils
Version range not reported
- python-oslo-versionedobjects
Version range not reported
- python-osprofiler
Version range not reported
- python-os-service-types
Version range not reported
- python-os-traits
Version range not reported
- python-paste
Version range not reported
- python-paste-deploy
Version range not reported
- python-pbr
Version range not reported
- python-pecan
Version range not reported
- python-pexpect
Version range not reported
- python-pint
Version range not reported
- python-platformdirs
Version range not reported
- python-proliantutils
Version range not reported
- python-prometheus_client
Version range not reported
- python-pyasn1
Version range not reported
- python-pycadf
Version range not reported
- python-pyperclip
Version range not reported
- python-redis
Version range not reported
- python-repoze-lru
Version range not reported
- python-requestsexceptions
Version range not reported
- python-requests-unixsocket
Version range not reported
- python-retrying
Version range not reported
- python-rfc3986
Version range not reported
- python-routes
Version range not reported
- python-scciclient
Version range not reported
- python-SecretStorage
Version range not reported
- python-setuptools
Version range not reported
- python-simplegeneric
Version range not reported
- python-simplejson
Version range not reported
- python-singledispatch
Version range not reported
- python-smi
Version range not reported
- python-smi-lextudio
Version range not reported
- python-soupsieve
Version range not reported
- python-sqlalchemy
Version range not reported
- python-sqlparse
Version range not reported
- python-statsd
Version range not reported
- python-stevedore
Version range not reported
- python-sushy-oem-idrac
Version range not reported
- python-swiftclient
Version range not reported
- python-tempita
Version range not reported
- python-tenacity
Version range not reported
- python-tooz
Version range not reported
- python-uhashring
Version range not reported
- python-vine
Version range not reported
- python-voluptuous
Version range not reported
- python-waitress
Version range not reported
- python-warlock
Version range not reported
- python-wcwidth
Version range not reported
- python-webencodings
Version range not reported
- python-webob
Version range not reported
- python-webtest
Version range not reported
- python-werkzeug
Version range not reported
- python-wrapt
Version range not reported
- python-wsme
Version range not reported
- python-yappi
Version range not reported
- python-zake
Version range not reported
- python-zeroconf
Version range not reported
- python-zipp
Version range not reported
- python-zope-event
Version range not reported
- python-zope-interface
Version range not reported
- runc
Version range not reported
- skopeo
Version range not reported
- toolbox
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- buildah
Version range not reported
- podman
Version range not reported
- github.com/containers/buildahGo
From 1.38.0 · fixed in 1.38.1
- github.com/containers/buildahGo
From 1.37.0 · fixed in 1.37.6
- github.com/containers/buildahGo
From 1.35.0 · fixed in 1.35.5
- github.com/containers/buildahGo
fixed in 1.33.12
- github.com/containers/buildahGo
fixed in 1.33.12; From 1.35.0 · fixed in 1.35.5; From 1.37.0 · fixed in 1.37.6; From 1.38.0 · fixed in 1.38.1
References 26
access.redhat.com
- errata/RHEA-2024:6126
- errata/RHSA-2025:0830
- errata/RHSA-2025:0878
- errata/RHSA-2025:0922
- errata/RHSA-2025:0923
- errata/RHSA-2025:1186
- errata/RHSA-2025:1187
- errata/RHSA-2025:1188
- errata/RHSA-2025:1189
- errata/RHSA-2025:1207
- errata/RHSA-2025:1275
- errata/RHSA-2025:1295
- errata/RHSA-2025:1296
- errata/RHSA-2025:1372
- errata/RHSA-2025:1453
- errata/RHSA-2025:1707
- errata/RHSA-2025:1713
- errata/RHSA-2025:1908
- errata/RHSA-2025:1910
- errata/RHSA-2025:1914
- errata/RHSA-2025:2441
- errata/RHSA-2025:2443
- errata/RHSA-2025:2454
- errata/RHSA-2025:2456
- errata/RHSA-2025:2701
- errata/RHSA-2025:2703
Questions about CVE-2024-11218
What does this mean?
A race condition in buildah's --jobs=2 build option can allow a container breakout when a malicious Containerfile is built, letting the build escape the container.Source: access.redhat.com, access.redhat.com
Am I affected, and how do I check?
Affected buildah releases are those before 1.33.12, 1.35.0 to before 1.35.5, 1.37.0 to before 1.37.6, and 1.38.0. Check the version with 'buildah --version' and whether builds use --jobs=2. Red Hat also lists Enterprise Linux 8, 9 and 10 and OpenShift Container Platform 4.12 to 4.18 as affected, so check the installed package version there.Source: access.redhat.com, access.redhat.com
What should I do about it?
Upgrade buildah to 1.33.12, 1.35.5, 1.37.6 or 1.38.1, matching your release branch. For Red Hat products, the advisory's fix package is podman 5.2.2-2.rhaos4.17.el9.Source: access.redhat.com, access.redhat.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data