Buildah: buildah allows arbitrary directory mount

Summary

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

Timeline

1. Oct 9, 2024, 2:32 PM UTCCVE published
2. Oct 9, 2024, 4:16 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Aug 7, 2026, 1:25 PM UTCRecord last updated

Affected versions

• buildah

  fixed in 1.38.0

• container-tools:rhel8

  Version range not reported

• container-tools:rhel8

  Version range not reported

• container-tools:rhel8

  Version range not reported

• container-tools:rhel8

  Version range not reported

• container-tools:rhel8

  Version range not reported

• buildah

  Version range not reported

• podman

  Version range not reported

• podman

  Version range not reported

• buildah

  Version range not reported

• buildah

  Version range not reported

• podman

  Version range not reported

• buildah

  Version range not reported

• podman

  Version range not reported

• openshift4/ose-docker-builder

  Version range not reported

• podman

  Version range not reported

• openshift4/ose-docker-builder

  Version range not reported

• podman

  Version range not reported

• openshift4/ose-docker-builder

  Version range not reported

• podman

  Version range not reported

• openshift4/ose-docker-builder

  Version range not reported

• podman

  Version range not reported

• openshift4/ose-docker-builder-rhel9

  Version range not reported

• podman

  Version range not reported

• openshift4/ose-docker-builder-rhel9

  Version range not reported

• openshift4/ose-docker-builder-rhel9

  Version range not reported

• quay/clair-rhel8

  Version range not reported

• quay/quay-bridge-operator-bundle

  Version range not reported

• quay/quay-bridge-operator-rhel8

  Version range not reported

• quay/quay-builder-qemu-rhcos-rhel8

  Version range not reported

• quay/quay-builder-rhel8

  Version range not reported

• quay/quay-container-security-operator-bundle

  Version range not reported

• quay/quay-container-security-operator-rhel8

  Version range not reported

• quay/quay-operator-bundle

  Version range not reported

• quay/quay-operator-rhel8

  Version range not reported

• quay/quay-rhel8

  Version range not reported

• ocp-tools-4/jenkins-agent-base-rhel8

  Version range not reported

• ocp-tools-4/jenkins-rhel8

  Version range not reported

• buildah

  Version range not reported

• podman

  Version range not reported

• skopeo

  Version range not reported

• conmon

  Version range not reported

• buildah

  Version range not reported

• conmon

  Version range not reported

• cri-o

  Version range not reported

• github.com/containers/buildahGo

  fixed in 1.38.0

• github.com/containers/buildahGo

  fixed in 1.37.1

References 25