CVE-2024-1753 Buildah: buildah: container escape via improper bind mount validation
Attackers can escape containers during build time by mounting the host filesystem via symbolic links, gaining read-write access to the host.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-1753?
CVE-2024-1753 is a high-severity path traversal vulnerability in Red Hat Enterprise Linux 7, published on 18 Mar 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.
Weakness: CWE-59
Which versions are affected by CVE-2024-1753?
21 open source packages ship an affected version, including github.com/containers/buildah, github.com/containers/podman/v4 and github.com/containers/podman/v5.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containers/buildah Go | All versions | 1.35.1 |
github.com/containers/buildah Go | From 1.24.0 | 1.24.7 |
github.com/containers/buildah Go | From 1.24.0 | 1.24.7 |
github.com/containers/buildah Go | From 1.25.0 | 1.27.4 |
github.com/containers/buildah Go | From 1.25.0 | 1.27.4 |
github.com/containers/buildah Go | From 1.28.0 | 1.29.3 |
15 more packages
github.com/containers/buildah Go | From 1.28.0 | 1.29.3 |
github.com/containers/buildah Go | From 1.30.0 | 1.31.5 |
github.com/containers/buildah Go | From 1.30.0 | 1.31.5 |
github.com/containers/buildah Go | From 1.32.0 | 1.32.3 |
github.com/containers/buildah Go | From 1.32.0 | 1.32.3 |
github.com/containers/buildah Go | From 1.33.0 | 1.33.7 |
github.com/containers/buildah Go | From 1.33.0 | 1.33.7 |
github.com/containers/buildah Go | From 1.34.0 | 1.34.3 |
github.com/containers/buildah Go | From 1.34.0 | 1.34.3 |
github.com/containers/buildah Go | From 1.35.0 | 1.35.1 |
github.com/containers/buildah Go | From 1.35.0 | 1.35.1 |
github.com/containers/podman/v4 Go | All versions | 4.9.4 |
github.com/containers/podman/v4 Go | All versions | 4.9.4 |
github.com/containers/podman/v5 Go | All versions | 5.0.1 |
github.com/containers/podman/v5 Go | All versions | 5.0.1 |
Linux distribution packages (19)
aardvark-dns AlmaLinux:8 | All versions | 2:1.0.1-38.module_el8.9.0+3627+db8ec155 |
aardvark-dns AlmaLinux:8 | All versions | 2:1.0.1-38.module_el8.9.0+3821+d7d58347 |
aardvark-dns AlmaLinux:8 | All versions | 2:1.7.0-1.module_el8.9.0+3657+d86e192f |
buildah AlmaLinux:8 | All versions | 1:1.24.7-1.module_el8.9.0+3821+d7d58347.alma.1 |
buildah AlmaLinux:8 | All versions | 1:1.31.5-1.module_el8.9.0+3823+03810114 |
buildah-tests AlmaLinux:8 | All versions | 1:1.24.7-1.module_el8.9.0+3821+d7d58347.alma.1 |
buildah-tests AlmaLinux:8 | All versions | 1:1.31.5-1.module_el8.9.0+3823+03810114 |
cockpit-podman AlmaLinux:8 | All versions | 46-1.module_el8.7.0+3344+5bcd850f |
cockpit-podman AlmaLinux:8 | All versions | 75-1.module_el8.9.0+3797+9f808d65 |
conmon AlmaLinux:8 | All versions | 2:2.1.4-2.module_el8.9.0+3627+db8ec155 |
conmon AlmaLinux:8 | All versions | 2:2.1.4-2.module_el8.9.0+3821+d7d58347 |
conmon AlmaLinux:8 | All versions | 3:2.1.8-1.module_el8.9.0+3755+bc5f21db |
container-selinux AlmaLinux:8 | All versions | 2:2.205.0-3.module_el8.9.0+3687+dcd7ef8f |
container-selinux AlmaLinux:8 | All versions | 2:2.229.0-1.module_el8.9.0+3755+bc5f21db |
containernetworking-plugins AlmaLinux:8 | All versions | 1:1.1.1-6.module_el8.9.0+3711+04fcca5e |
containernetworking-plugins AlmaLinux:8 | All versions | 1:1.1.1-6.module_el8.9.0+3821+d7d58347 |
containernetworking-plugins AlmaLinux:8 | All versions | 1:1.3.0-8.module_el8.9.0+3717+81096349 |
containers-common AlmaLinux:8 | All versions | 2:1-38.module_el8.9.0+3627+db8ec155 |
containers-common AlmaLinux:8 | All versions | 2:1-38.module_el8.9.0+3821+d7d58347 |
How do I fix CVE-2024-1753?
Upgrade github.com/containers/buildah to a fixed version for your release line: 1.35.1, 1.24.7, 1.27.4 or 1.29.3.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-1753 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-1753 exists.
Sources
Also known as ALSA-2024:2055, ALSA-2024:2084, ALSA-2024:2098, AZL-36899, AZL-42506, AZL-42509 and 29 more.