CVE-2021-3602 Buildah processes using chroot isolation may leak environment values to intermediate processes
Attackers can read sensitive environment variables from parent processes during container builds, potentially exposing credentials in CI/CD environments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3602?
CVE-2021-3602 is a medium-severity vulnerability in Redhat Enterprise Linux, published on 3 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
Which versions are affected by CVE-2021-3602?
9 open source packages ship an affected version, including github.com/containers/buildah. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containers/buildah Go | All versions | 1.16.8 |
github.com/containers/buildah Go | All versions | 1.16.8 |
github.com/containers/buildah Go | All versions | 1.22.0 |
github.com/containers/buildah Go | From 1.17.0 | 1.17.2 |
github.com/containers/buildah Go | From 1.17.0 | 1.17.2 |
github.com/containers/buildah Go | From 1.18.0 | 1.19.9 |
3 more packages
github.com/containers/buildah Go | From 1.18.0 | 1.19.9 |
github.com/containers/buildah Go | From 1.20.0 | 1.21.3 |
github.com/containers/buildah Go | From 1.20.0 | 1.21.3 |
Linux distribution packages (31)
buildah AlmaLinux:8 | All versions | 1.19.9-1.module_el8.5.0+2614+87221ce8 |
buildah-tests AlmaLinux:8 | All versions | 1.19.9-1.module_el8.5.0+2614+87221ce8 |
cockpit-podman AlmaLinux:8 | All versions | 11-1.module_el8.5.0+108+00865455 |
cockpit-podman AlmaLinux:8 | All versions | 11-1.module_el8.5.0+2635+e4386a39 |
cockpit-podman AlmaLinux:8 | All versions | 29-2.module_el8.5.0+2614+87221ce8 |
cockpit-podman AlmaLinux:8 | All versions | 29-2.module_el8.6.0+2876+9ed4eae2 |
conmon AlmaLinux:8 | All versions | 2:2.0.15-1.module_el8.5.0+108+00865455 |
conmon AlmaLinux:8 | All versions | 2:2.0.15-1.module_el8.5.0+2635+e4386a39 |
conmon AlmaLinux:8 | All versions | 2:2.0.26-1.module_el8.5.0+2614+87221ce8 |
conmon AlmaLinux:8 | All versions | 2:2.0.26-1.module_el8.6.0+2876+9ed4eae2 |
container-selinux AlmaLinux:8 | All versions | 2:2.130.0-1.module_el8.5.0+108+00865455 |
container-selinux AlmaLinux:8 | All versions | 2:2.130.0-1.module_el8.5.0+2635+e4386a39 |
container-selinux AlmaLinux:8 | All versions | 2:2.167.0-1.module_el8.5.0+2614+87221ce8 |
containernetworking-plugins AlmaLinux:8 | All versions | 0.8.3-4.module_el8.5.0+108+00865455 |
containernetworking-plugins AlmaLinux:8 | All versions | 0.8.3-4.module_el8.5.0+2635+e4386a39 |
containernetworking-plugins AlmaLinux:8 | All versions | 0.9.1-1.module_el8.5.0+2614+87221ce8 |
containernetworking-plugins AlmaLinux:8 | All versions | 0.9.1-1.module_el8.6.0+2876+9ed4eae2 |
containers-common AlmaLinux:8 | All versions | 1:0.1.41-4.module_el8.5.0+108+00865455 |
containers-common AlmaLinux:8 | All versions | 1:0.1.41-4.module_el8.5.0+2635+e4386a39 |
crit AlmaLinux:8 | All versions | 3.12-9.module_el8.3.0+2044+12421f43 |
crit AlmaLinux:8 | All versions | 3.12-9.module_el8.4.0+2496+12421f43 |
crit AlmaLinux:8 | All versions | 3.12-9.module_el8.5.0+119+9a9ec082 |
crit AlmaLinux:8 | All versions | 3.15-1.module_el8.5.0+2614+87221ce8 |
crit AlmaLinux:8 | All versions | 3.15-1.module_el8.6.0+2876+9ed4eae2 |
criu AlmaLinux:8 | All versions | 3.12-9.module_el8.3.0+2044+12421f43 |
criu AlmaLinux:8 | All versions | 3.12-9.module_el8.4.0+2496+12421f43 |
criu AlmaLinux:8 | All versions | 3.12-9.module_el8.5.0+119+9a9ec082 |
criu AlmaLinux:8 | All versions | 3.15-1.module_el8.5.0+2614+87221ce8 |
criu AlmaLinux:8 | All versions | 3.15-1.module_el8.6.0+2876+9ed4eae2 |
crun AlmaLinux:8 | All versions | 0.18-2.module_el8.5.0+2614+87221ce8 |
fuse-overlayfs AlmaLinux:8 | All versions | 0.7.8-1.module_el8.5.0+108+00865455 |
Products include Buildah Project Buildah, Redhat Enterprise Linux, Redhat Enterprise Linux for Ibm Z Systems, Redhat Enterprise Linux for Power Little Endian.
How do I fix CVE-2021-3602?
Upgrade github.com/containers/buildah to a fixed version for your release line: 1.16.8, 1.22.0, 1.17.2 or 1.19.9.
Is CVE-2021-3602 being exploited?
There is no known exploitation of CVE-2021-3602 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2020-10696 Path Traversal in Buildah
- CVE-2024-9675 Buildah: buildah allows arbitrary directory mount
- CVE-2022-2990 Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification
- CVE-2022-27651 Non-empty default inheritable capabilities for linux container in Buildah
- CVE-2019-10214 containers/image library Insufficiently Protects Credentials
Sources
Also known as ALSA-2021:4221, ALSA-2021:4222, AZL-39837, AZL-44154, CLEANSTART-2024-UF47484, DEBIAN-CVE-2021-3602 and 7 more.