Read the docs
TI-2024-01631 Aliases CVE-2024-1753GHSA-874v-pj72-92f3

Buildah: buildah: container escape via improper bind mount validation

Priority HIGH 72CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 10 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-269.

Summary

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00457 39th percentileScored 2026-11-07
Fix Partial github.com/containers/podman/v4 (Go): 4.9.4github.com/containers/podman/v5 (Go): 5.0.1Red Hat: 17 advisoriesRed Hat: 10 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—buildah4.15.0—No fix listedCNA
Red HatRed Hat Enterprise Linux 8—8090020240413110917.d7b6f4b7Patch availableCNA
Red HatRed Hat Enterprise Linux 8—8090020240417184044.e7857ab1Patch availableCNA
Red HatRed Hat Enterprise Linux 8—8100020240419145834.afee755dPatch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support—8060020240422155330.3b538bd8Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support—8060020240419071711.2e213529Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—8080020240422101606.0f77c1b7Patch availableCNA
Red HatRed Hat Enterprise Linux 9—1:1.31.5-1.el9_3Patch availableCNA
Red HatRed Hat Enterprise Linux 9—4:4.9.4-3.el9_4Patch availableCNA
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support—1:1.26.7-1.el9_0Patch availableCNA
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support—2:4.2.0-3.el9_0Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—1:1.29.3-1.el9_2Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—2:4.4.1-16.el9_2Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.12—3:4.4.1-3.2.rhaos4.12.el8Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.13—3:4.4.1-5.3.rhaos4.13.el8Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.13—3:4.4.1-7.3.rhaos4.13.el8Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.14—3:4.4.1-13.4.rhaos4.14.el8Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.15—3:4.4.1-23.2.rhaos4.15.el8Patch availableCNA
Red HatRed Hat Enterprise Linux 7——Not affectedCNA
Red HatRed Hat Enterprise Linux 7——No fix listedCNA
Red HatRed Hat OpenShift Container Platform 3.11——No fix listedCNA
—github.com/containers/podman/v4 (Go)before 4.9.44.9.4Patch availableGHSA-874v-pj72-92f3
—github.com/containers/podman/v5 (Go)before 5.0.15.0.1Patch availableGHSA-874v-pj72-92f3
  • buildah Vendor— Affected 4.15.0 Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8090020240413110917.d7b6f4b7 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8090020240417184044.e7857ab1 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020240419145834.afee755d Patch available CNA
  • Red Hat Enterprise Linux 8.6 Extended Update Support VendorRed Hat Affected — Fixed in 8060020240422155330.3b538bd8 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Extended Update Support VendorRed Hat Affected — Fixed in 8060020240419071711.2e213529 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 8080020240422101606.0f77c1b7 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1:1.31.5-1.el9_3 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 4:4.9.4-3.el9_4 Patch available CNA
  • Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 1:1.26.7-1.el9_0 Patch available CNA
  • Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 2:4.2.0-3.el9_0 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 1:1.29.3-1.el9_2 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 2:4.4.1-16.el9_2 Patch available CNA
  • Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 3:4.4.1-3.2.rhaos4.12.el8 Patch available CNA
  • Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 3:4.4.1-5.3.rhaos4.13.el8 Patch available CNA
  • Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 3:4.4.1-7.3.rhaos4.13.el8 Patch available CNA
  • Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 3:4.4.1-13.4.rhaos4.14.el8 Patch available CNA
  • Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 3:4.4.1-23.2.rhaos4.15.el8 Patch available CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenShift Container Platform 3.11 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • github.com/containers/podman/v4 (Go) Vendor— Affected before 4.9.4 Fixed in 4.9.4 Patch available GHSA-874v-pj72-92f3
  • github.com/containers/podman/v5 (Go) Vendor— Affected before 5.0.1 Fixed in 5.0.1 Patch available GHSA-874v-pj72-92f3

CPE names CNA · 16

CPEVersionsRoleVendor
cpe:/a:redhat:enterprise_linux:8::appstream8—Red Hat
cpe:/a:redhat:rhel_eus:8.6::appstream8.6—Red Hat
cpe:/a:redhat:rhel_eus:8.8::appstream8.8—Red Hat
cpe:/a:redhat:enterprise_linux:9::appstream9—Red Hat
cpe:/a:redhat:rhel_eus:9.0::appstream9.0—Red Hat
cpe:/a:redhat:rhel_eus:9.2::appstream9.2—Red Hat
cpe:/a:redhat:openshift:4.12::el84.12—Red Hat
cpe:/a:redhat:openshift:4.12::el94.12—Red Hat
cpe:/a:redhat:openshift:4.13::el84.13—Red Hat
cpe:/a:redhat:openshift:4.13::el94.13—Red Hat
  • cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:8.6::appstream Versions 8.6 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:8.8::appstream Versions 8.8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.0::appstream Versions 9.0 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.2::appstream Versions 9.2 — ·Red Hat
  • cpe:/a:redhat:openshift:4.12::el8 Versions 4.12 — ·Red Hat
  • cpe:/a:redhat:openshift:4.12::el9 Versions 4.12 — ·Red Hat
  • cpe:/a:redhat:openshift:4.13::el8 Versions 4.13 — ·Red Hat
  • cpe:/a:redhat:openshift:4.13::el9 Versions 4.13 — ·Red Hat
Show 6 more CPE
CPEVersionsRoleVendor
cpe:/a:redhat:openshift:4.14::el84.14—Red Hat
cpe:/a:redhat:openshift:4.14::el94.14—Red Hat
cpe:/a:redhat:openshift:4.15::el84.15—Red Hat
cpe:/a:redhat:openshift:4.15::el94.15—Red Hat
cpe:/o:redhat:rhel_els:77—Red Hat
cpe:/a:redhat:openshift:3.113.11—Red Hat
  • cpe:/a:redhat:openshift:4.14::el8 Versions 4.14 — ·Red Hat
  • cpe:/a:redhat:openshift:4.14::el9 Versions 4.14 — ·Red Hat
  • cpe:/a:redhat:openshift:4.15::el8 Versions 4.15 — ·Red Hat
  • cpe:/a:redhat:openshift:4.15::el9 Versions 4.15 — ·Red Hat
  • cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:openshift:3.11 Versions 3.11 — ·Red Hat

Remediation

  • Fix · GHSA-874v-pj72-92f3 github.com/containers/podman/v4 (Go) Fixed in 4.9.4 Advisory →
  • Fix · GHSA-874v-pj72-92f3 github.com/containers/podman/v5 (Go) Fixed in 5.0.1 Advisory →

Red Hat 17 advisories

  • RHSA-2024:2877 Released 2024-05-23 · Red Hat rating Important
    OpenShift Container Platform 4.13.42 packages and security update
    • Red Hat OpenShift Container Platform 4.13 cri-o-1.26.5-15.2.rhaos4.13.gitb742e63.el8, cri-o-1.26.5-15.2.rhaos4.13.gitb742e63.el9, podman-3:4.4.1-7.3.rhaos4.13.el8 +12
  • RHSA-2024:3254 Released 2024-05-22 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x::container-tools:rhel8 +47
  • RHSA-2024:2784 Released 2024-05-16 · Red Hat rating Important
    OpenShift Container Platform 4.12.57 security update
    • Red Hat OpenShift Container Platform 4.12 cri-o-1.25.5-16.2.rhaos4.12.gitcb09013.el8, podman-3:4.4.1-3.2.rhaos4.12.el8, podman-catatonit-3:4.4.1-3.2.rhaos4.12.el8 +9
Show 14 more Red Hat advisories
  • RHSA-2024:2672 Released 2024-05-09 · Red Hat rating Important
    OpenShift Container Platform 4.14.24 packages and security update
    • Red Hat OpenShift Container Platform 4.14 cri-o-1.27.6-2.rhaos4.14.gitb3bd0bf.el8, cri-o-1.27.6-2.rhaos4.14.gitb3bd0bf.el9, openshift-4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el8 +16
  • RHSA-2024:2669 Released 2024-05-09 · Red Hat rating Important
    OpenShift Container Platform 4.15.12 security update
    • Red Hat OpenShift Container Platform 4.15 cri-o-1.28.6-2.rhaos4.15.git77bbb1c.el8, cri-o-1.28.6-2.rhaos4.15.git77bbb1c.el9, podman-3:4.4.1-23.2.rhaos4.15.el8 +12
  • RHSA-2024:2049 Released 2024-05-02 · Red Hat rating Important
    OpenShift Container Platform 4.13.41 packages and security update
    • Red Hat OpenShift Container Platform 4.13 openshift-4.13.0-202404222036.p0.g4818370.assembly.stream.el8, openshift-4.13.0-202404222036.p0.g4818370.assembly.stream.el9, openshift-hyperkube-4.13.0-202404222036.p0.g4818370.assembly.stream.el8 +18
  • RHSA-2024:2645 Released 2024-05-01 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) podman-2:4.4.1-16.el9_2, podman-docker-2:4.4.1-16.el9_2, podman-gvproxy-2:4.4.1-16.el9_2 +3
  • RHSA-2024:2089 Released 2024-04-30 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) podman-2:4.2.0-3.el9_0, podman-catatonit-2:4.2.0-3.el9_0, podman-docker-2:4.2.0-3.el9_0 +4
  • RHSA-2024:2090 Released 2024-04-30 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+21745+f5f35196.aarch64::container-tools:rhel8, aardvark-dns-2:1.0.1-40.module+el8.6.0+21745+f5f35196.ppc64le::container-tools:rhel8, aardvark-dns-2:1.0.1-40.module+el8.6.0+21745+f5f35196.s390x::container-tools:rhel8 +47
  • RHSA-2024:2548 Released 2024-04-30 · Red Hat rating Moderate
    podman security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-4:4.9.4-3.el9_4, podman-docker-4:4.9.4-3.el9_4, podman-plugins-4:4.9.4-3.el9_4 +2
  • RHSA-2024:2084 Released 2024-04-29 · Red Hat rating Important
    container-tools:4.0 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+21673+408ce8ab.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+21673+408ce8ab.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+21673+408ce8ab.s390x::container-tools:4.0 +47
  • RHSA-2024:2077 Released 2024-04-29 · Red Hat rating Important
    container-tools:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+21741+dd5be1e7.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+21741+dd5be1e7.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+21741+dd5be1e7.s390x::container-tools:rhel8 +47
  • RHSA-2024:2098 Released 2024-04-29 · Red Hat rating Important
    container-tools:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.7.0-1.module+el8.9.0+21697+6a5e98e7.aarch64::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+21697+6a5e98e7.ppc64le::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+21697+6a5e98e7.s390x::container-tools:rhel8 +47
  • RHSA-2024:2097 Released 2024-04-29 · Red Hat rating Important
    container-tools:4.0 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) aardvark-dns-2:1.0.1-29.module+el8.6.0+21719+09b58c97.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-29.module+el8.6.0+21719+09b58c97.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-29.module+el8.6.0+21719+09b58c97.s390x::container-tools:4.0 +47
  • RHSA-2024:2066 Released 2024-04-25 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) buildah-1:1.26.7-1.el9_0, buildah-tests-1:1.26.7-1.el9_0
  • RHSA-2024:2064 Released 2024-04-25 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) buildah-1:1.29.3-1.el9_2, buildah-tests-1:1.29.3-1.el9_2
  • RHSA-2024:2055 Released 2024-04-25 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.31.5-1.el9_3, buildah-tests-1:1.31.5-1.el9_3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:2084, RHSA-2024:2098, RHSA-2024:3254
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:2055, RHSA-2024:2548
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2024:2090, RHSA-2024:2097
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:2077
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2024:2066, RHSA-2024:2089
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:2064, RHSA-2024:2645
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2024:2784
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2024:2049, RHSA-2024:2877
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2024:2672
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2024:2669
Not affected: 5 products
  • Red Hat Enterprise Linux 7
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1753
  2. 2026-10-03 Alias added: GHSA-874v-pj72-92f3

References

Advisory 18

Other 9

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences