A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | RedHat | container-tools:4.0-8090020240413110917.d7b6f4b7 | * |
| Red Hat Enterprise Linux 8 | RedHat | container-tools:rhel8-8090020240417184044.e7857ab1 | * |
| Red Hat Enterprise Linux 8 | RedHat | container-tools:rhel8-8100020240419145834.afee755d | * |
| Red Hat Enterprise Linux 8.6 Extended Update Support | RedHat | container-tools:rhel8-8060020240422155330.3b538bd8 | * |
| Red Hat Enterprise Linux 8.6 Extended Update Support | RedHat | container-tools:4.0-8060020240419071711.2e213529 | * |
| Red Hat Enterprise Linux 8.8 Extended Update Support | RedHat | container-tools:rhel8-8080020240422101606.0f77c1b7 | * |
| Red Hat Enterprise Linux 9 | RedHat | buildah-1:1.31.5-1.el9_3 | * |
| Red Hat Enterprise Linux 9 | RedHat | podman-4:4.9.4-3.el9_4 | * |
| Red Hat Enterprise Linux 9.0 Extended Update Support | RedHat | buildah-1:1.26.7-1.el9_0 | * |
| Red Hat Enterprise Linux 9.0 Extended Update Support | RedHat | podman-2:4.2.0-3.el9_0 | * |
| Red Hat Enterprise Linux 9.2 Extended Update Support | RedHat | buildah-1:1.29.3-1.el9_2 | * |
| Red Hat Enterprise Linux 9.2 Extended Update Support | RedHat | podman-2:4.4.1-16.el9_2 | * |
| Red Hat OpenShift Container Platform 4.12 | RedHat | podman-3:4.4.1-3.2.rhaos4.12.el8 | * |
| Red Hat OpenShift Container Platform 4.13 | RedHat | podman-3:4.4.1-6.3.rhaos4.13.el9 | * |
| Red Hat OpenShift Container Platform 4.13 | RedHat | podman-3:4.4.1-7.3.rhaos4.13.el8 | * |
| Red Hat OpenShift Container Platform 4.14 | RedHat | podman-3:4.4.1-13.4.rhaos4.14.el8 | * |
| Red Hat OpenShift Container Platform 4.15 | RedHat | podman-3:4.4.1-23.2.rhaos4.15.el8 | * |
| Golang-github-containers-buildah | Ubuntu | mantic | * |