Read the docs
TI-2024-08728 Aliases CVE-2024-9407GHSA-fhqq-8f65-5xfc

Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction

Priority LOW 23CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Partial Red Hat: 4 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00288 21st percentileScored 2026-11-07
Fix Partial podman: 5.2.4buildah: 1.37.4+6 more productsRed Hat: 6 advisoriesRed Hat: 4 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—podmanbefore 5.2.45.2.4Patch availableCNA
—buildahbefore 1.37.41.37.4Patch availableCNA
Red HatRed Hat Enterprise Linux 8—8100020241023085649.afee755dPatch availableCNA
Red HatRed Hat Enterprise Linux 9—4:4.9.4-16.el9_4Patch availableCNA
Red HatRed Hat Enterprise Linux 9—4:5.2.2-9.el9_5Patch availableCNA
Red HatRed Hat Enterprise Linux 9—2:1.37.5-1.el9_5Patch availableCNA
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—2:1.33.11-1.el9_4Patch availableCNA
Red HatRed Hat OpenShift Container Platform 4.16—416.94.202411201433-0Patch availableCNA
Red HatRed Hat Enterprise Linux 10——No fix listedCNA
Red HatRed Hat Enterprise Linux 10——No fix listedCNA
Red HatRed Hat OpenShift Container Platform 4——Not affectedCNA
Red HatRed Hat OpenShift Container Platform 4——No fix listedCNA
—github.com/containers/buildah (Go)before 1.37.41.37.4Patch availableGHSA-fhqq-8f65-5xfc
—github.com/containers/podman/v5 (Go)before 5.2.45.2.4Patch availableGHSA-fhqq-8f65-5xfc
—github.com/containers/podman (Go)before 5.2.45.2.4Patch availableGHSA-fhqq-8f65-5xfc
—github.com/containers/podman/v2 (Go)before 5.2.45.2.4Patch availableGHSA-fhqq-8f65-5xfc
—github.com/containers/podman/v3 (Go)before 5.2.45.2.4Patch availableGHSA-fhqq-8f65-5xfc
—github.com/containers/podman/v4 (Go)before 5.2.45.2.4Patch availableGHSA-fhqq-8f65-5xfc
  • podman Vendor— Affected before 5.2.4 Fixed in 5.2.4 Patch available CNA
  • buildah Vendor— Affected before 1.37.4 Fixed in 1.37.4 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020241023085649.afee755d Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 4:4.9.4-16.el9_4 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 4:5.2.2-9.el9_5 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2:1.37.5-1.el9_5 Patch available CNA
  • Red Hat Enterprise Linux 9.4 Extended Update Support VendorRed Hat Affected — Fixed in 2:1.33.11-1.el9_4 Patch available CNA
  • Red Hat OpenShift Container Platform 4.16 VendorRed Hat Affected — Fixed in 416.94.202411201433-0 Patch available CNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • github.com/containers/buildah (Go) Vendor— Affected before 1.37.4 Fixed in 1.37.4 Patch available GHSA-fhqq-8f65-5xfc
  • github.com/containers/podman/v5 (Go) Vendor— Affected before 5.2.4 Fixed in 5.2.4 Patch available GHSA-fhqq-8f65-5xfc
  • github.com/containers/podman (Go) Vendor— Affected before 5.2.4 Fixed in 5.2.4 Patch available GHSA-fhqq-8f65-5xfc
  • github.com/containers/podman/v2 (Go) Vendor— Affected before 5.2.4 Fixed in 5.2.4 Patch available GHSA-fhqq-8f65-5xfc
  • github.com/containers/podman/v3 (Go) Vendor— Affected before 5.2.4 Fixed in 5.2.4 Patch available GHSA-fhqq-8f65-5xfc
  • github.com/containers/podman/v4 (Go) Vendor— Affected before 5.2.4 Fixed in 5.2.4 Patch available GHSA-fhqq-8f65-5xfc

CPE names CNA · 6

CPEVersionsRoleVendor
cpe:/a:redhat:enterprise_linux:8::appstream8—Red Hat
cpe:/a:redhat:enterprise_linux:9::appstream9—Red Hat
cpe:/a:redhat:rhel_eus:9.4::appstream9.4—Red Hat
cpe:/a:redhat:openshift:4.16::el94.16—Red Hat
cpe:/a:redhat:enterprise_linux:1010—Red Hat
cpe:/a:redhat:openshift:44—Red Hat
  • cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.4::appstream Versions 9.4 — ·Red Hat
  • cpe:/a:redhat:openshift:4.16::el9 Versions 4.16 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:10 Versions 10 — ·Red Hat
  • cpe:/a:redhat:openshift:4 Versions 4 — ·Red Hat

Remediation

  • Fix · CNA podman Fixed in 5.2.4
  • Fix · CNA buildah Fixed in 1.37.4
  • Fix · GHSA-fhqq-8f65-5xfc github.com/containers/buildah (Go) Fixed in 1.37.4 Advisory →
  • Fix · GHSA-fhqq-8f65-5xfc github.com/containers/podman/v5 (Go) Fixed in 5.2.4 Advisory →
  • Fix · GHSA-fhqq-8f65-5xfc github.com/containers/podman (Go) Fixed in 5.2.4 Advisory →
  • Fix · GHSA-fhqq-8f65-5xfc github.com/containers/podman/v2 (Go) Fixed in 5.2.4 Advisory →
  • Fix · GHSA-fhqq-8f65-5xfc github.com/containers/podman/v3 (Go) Fixed in 5.2.4 Advisory →
  • Fix · GHSA-fhqq-8f65-5xfc github.com/containers/podman/v4 (Go) Fixed in 5.2.4 Advisory →

Red Hat 6 advisories

  • RHSA-2024:10147 Released 2024-11-26 · Red Hat rating Moderate
    OpenShift Container Platform 4.16.24 security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/ose-nutanix-cloud-controller-manager-rhel9, rhcos
  • RHSA-2024:9926 Released 2024-11-19 · Red Hat rating Moderate
    buildah security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) buildah-2:1.33.11-1.el9_4, buildah-tests-2:1.33.11-1.el9_4
  • RHSA-2024:9454 Released 2024-11-12 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-4:5.2.2-9.el9_5, podman-docker-4:5.2.2-9.el9_5, podman-plugins-4:5.2.2-9.el9_5 +2
Show 3 more Red Hat advisories
  • RHSA-2024:9459 Released 2024-11-12 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.37.5-1.el9_5, buildah-tests-2:1.37.5-1.el9_5
  • RHSA-2024:9051 Released 2024-11-11 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-4:4.9.4-16.el9_4, podman-docker-4:4.9.4-16.el9_4, podman-plugins-4:4.9.4-16.el9_4 +2
  • RHSA-2024:8846 Released 2024-11-05 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.1-2.module+el8.10.0+22397+e3c95ba6.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+22397+e3c95ba6.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+22397+e3c95ba6.s390x::container-tools:rhel8 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 and 2 more products — RHSA-2024:10147

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2024-08665 Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go libraryPriority LOW 38
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:8846
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:9051, RHSA-2024:9454, RHSA-2024:9459
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2024:9926
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2024:10147
Not affected: 2 products
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.16

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-9407
  2. 2026-10-03 Alias added: GHSA-fhqq-8f65-5xfc
  3. 2026-10-13 Fix available: openshift/[email protected] · CNA
  4. 2026-10-23 Affected versions changed · CNA

References

Advisory 7

Other 7

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences