Buildah: buildah: container escape via improper bind mount validation

Summary

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

Timeline

1. Mar 18, 2024, 2:23 PM UTCCVE published
2. May 2, 2024, 3:05 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: no · Technical impact: total

3. Sep 24, 2026, 11:35 PM UTCRecord last updated

Affected versions

• buildah

  4.15.0

• container-tools:4.0

  Version range not reported

• container-tools:rhel8

  Version range not reported

• container-tools:rhel8

  Version range not reported

• container-tools:4.0

  Version range not reported

• container-tools:rhel8

  Version range not reported

• buildah

  Version range not reported

• podman

  Version range not reported

• buildah

  Version range not reported

• podman

  Version range not reported

• buildah

  Version range not reported

• podman

  Version range not reported

• podman

  Version range not reported

• podman

  Version range not reported

• podman

  Version range not reported

• podman

  Version range not reported

• buildah

  Version range not reported

• podman

  Version range not reported

• podman

  Version range not reported

• github.com/containers/podman/v4Go

  fixed in 4.9.4

• github.com/containers/podman/v5Go

  fixed in 5.0.1

• github.com/containers/buildahGo

  From 1.35.0 · fixed in 1.35.1

• github.com/containers/buildahGo

  From 1.34.0 · fixed in 1.34.3

• github.com/containers/buildahGo

  From 1.33.0 · fixed in 1.33.7

• github.com/containers/buildahGo

  From 1.25.0 · fixed in 1.27.4

• github.com/containers/buildahGo

  From 1.24.0 · fixed in 1.24.7

• github.com/containers/buildahGo

  From 1.28.0 · fixed in 1.29.3

• github.com/containers/buildahGo

  From 1.30.0 · fixed in 1.31.5

• github.com/containers/buildahGo

  From 1.32.0 · fixed in 1.32.3

• github.com/containers/buildahGo

  fixed in 1.35.1

References 22