NetSight
IP …
high7.8

CVE-2024-9675

Buildah allows arbitrary directory mount

Impact

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

Affected packages

EcosystemPackageAffectedFixed in
gogithub.com/containers/buildah< 1.38.01.38.0

Affected products

VendorProductAffected versions
Buildah ProjectBuildah
All versions
RedhatOpenshift Container Platform
Versions 4.13, 4.14, 4.15, 4.16, 4.17
RedhatEnterprise Linux
Versions 8.0, 9.0
RedhatEnterprise Linux Eus
Versions 8.8, 9.0, 9.2, 9.4
RedhatEnterprise Linux For Arm 64
Versions 8.0_aarch64, 9.0_aarch64
RedhatEnterprise Linux For Arm 64 Eus
Versions 8.8_aarch64, 9.0_aarch64, 9.2_aarch64, 9.4_aarch64
RedhatEnterprise Linux For Ibm Z Systems
Versions 8.0_s390x, 9.0_s390x
RedhatEnterprise Linux For Ibm Z Systems Eus
Versions 8.8_s390x, 9.0_s390x, 9.2_s390x, 9.4_s390x
RedhatEnterprise Linux For Power Little Endian
Versions 8.0_ppc64le, 9.0_ppc64le
RedhatEnterprise Linux For Power Little Endian Eus
Versions 8.8_ppc64le, 9.0_ppc64le, 9.2_ppc64le, 9.4_ppc64le
RedhatEnterprise Linux Server Aus
Versions 8.6, 9.2, 9.4
RedhatEnterprise Linux Server For Power Little Endian Update Services For Sap Solutions
Versions 8.6_ppc64le, 8.8_ppc64le, 9.0_ppc64le, 9.2_ppc64le, 9.4_ppc64le
Red HatRed Hat OpenShift Container Platform 4.14
Versions patch: 3:4.4.1-21.rhaos4.14.el8, patch: v4.14.0-202503060906.p0.gb03f3f5.assembly.stream.el8
Red HatRed Hat OpenShift Container Platform 4.18
Versions patch: 0:4.18.0-202412111238.p0.g9c24d76.assembly.stream.el8, patch: 1:5.5.0-0.20240926163413.a635649.el9, patch: 0:2.1-2.el9, patch: 0:4.2.0-20.el9.1, patch: 0:4.4.2-6.0.el9, patch: 0:4.18.0-202502032331.p0.ga50d4c0.assembly.stream.el8
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support
Versions patch: 2:4.2.0-5.el9_0.2, patch: 1:1.26.8-2.el9_0
Red HatRed Hat OpenShift Container Platform 4.12
Version patch: v4.12.0-202503181728.p0.ge355452.assembly.stream.el8
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Version patch: 8060020241028154646.3b538bd8
Red HatRed Hat OpenShift Container Platform 4.16
Versions patch: 4:4.9.4-12.rhaos4.16.el8, patch: v4.16.0-202503121138.p0.g31c3c26.assembly.stream.el9
Red HatRed Hat Quay 3
Versions patch: v3.13.2-11, patch: v3.13.2-1, patch: v3.13.2-10, patch: v3.13.2-2, patch: v3.13.2-4
Red HatRed Hat OpenShift Container Platform 4.17
Versions patch: v4.17.0-202503041005.p0.gc3b0999.assembly.stream.el9, patch: 5:5.2.2-1.rhaos4.17.el8
Red HatRed Hat Enterprise Linux 9
Versions patch: 2:1.37.5-1.el9_5, patch: 4:4.9.4-16.el9_4, patch: 2:1.33.10-1.el9_4, patch: 4:5.2.2-9.el9_5
Red HatRed Hat OpenShift Container Platform 4.15
Versions patch: 3:4.4.1-32.rhaos4.15.el8, patch: v4.15.0-202503060734.p0.gbc0b789.assembly.stream.el8
Red HatRed Hat Enterprise Linux 8
Version patch: 8100020241023085649.afee755d
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support
Version patch: 8080020241025064551.0f77c1b7

Weakness classification

CWE-22

References