Loading vulnerability…
Arbitrary host directory mounting in Buildah cache mounts
CVE-2024-9675 is a path-validation vulnerability in Buildah's cache mount handling. Buildah does not adequately verify that user-specified cache paths remain within the designated cache directory. A crafted RUN instruction in a container build definition can consequently mount an arbitrary host directory into the build container with read/write access. Host filesystem access remains constrained by the permissions of the user running Buildah.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exposes host files outside the intended cache directory to reading or modification from the build container, compromising confidentiality and integrity within the Buildah user's filesystem permissions. The vulnerability does not itself bypass host filesystem permissions. The CVSS v3 assessment indicates low confidentiality and integrity impacts and no availability impact.
If you can’t patch tonight, do this now.
Do not build untrusted Containerfiles or use untrusted cache-mount arguments on vulnerable Buildah installations. Restrict Buildah execution to dedicated, minimally privileged build accounts; limit that account's host filesystem permissions; isolate build hosts; and prevent untrusted users from modifying Containerfiles, build contexts, or CI/CD build definitions.
Patch, then assume compromise.
Upgrade Buildah to version 1.38.0 or later, or install the applicable vendor-backported security update. Fixed distribution packages include Buildah 1.37.5-1.el9_5 for RHEL 9 under RHSA-2024:9459 and Buildah 1.33.10-1.module+el8.10.0+22397+e3c95ba6 for the RHEL 8 container-tools module under RHSA-2024:8846. For affected OpenShift deployments, apply the updated packages and container images through the supported release channel.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.