CVE-2024-9675 Buildah: buildah allows arbitrary directory mount
Attackers can mount arbitrary host directories into containers via malicious RUN instructions, enabling unauthorized host file access and modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-9675?
CVE-2024-9675 is a high-severity path traversal vulnerability in Redhat Enterprise Linux, published on 9 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.
Weakness: CWE-22
Which versions are affected by CVE-2024-9675?
3 open source packages ship an affected version, including github.com/containers/buildah. It affects 14 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containers/buildah Go | All versions | 1.37.1 |
github.com/containers/buildah Go | All versions | 1.38.0 |
github.com/containers/buildah Go | All versions | 1.38.0 |
Linux distribution packages (37)
buildah AlmaLinux:9 | All versions | 2:1.33.10-1.el9_4 |
buildah-tests AlmaLinux:9 | All versions | 2:1.33.10-1.el9_4 |
buildah Red Hat:enterprise_linux:9::appstream | All versions | 2:1.33.10-1.el9_4 |
buildah-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:1.33.10-1.el9_4 |
buildah-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 2:1.33.10-1.el9_4 |
buildah-tests Red Hat:enterprise_linux:9::appstream | All versions | 2:1.33.10-1.el9_4 |
buildah-tests-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:1.33.10-1.el9_4 |
podman Red Hat:openshift:4.15::el8 | All versions | 3:4.4.1-32.rhaos4.15.el8 |
podman-catatonit Red Hat:openshift:4.15::el8 | All versions | 3:4.4.1-32.rhaos4.15.el8 |
podman-catatonit-debuginfo Red Hat:openshift:4.15::el8 | All versions | 3:4.4.1-32.rhaos4.15.el8 |
podman-debuginfo Red Hat:openshift:4.15::el8 | All versions | 3:4.4.1-32.rhaos4.15.el8 |
podman-debugsource Red Hat:openshift:4.15::el8 | All versions | 3:4.4.1-32.rhaos4.15.el8 |
podman-docker Red Hat:openshift:4.15::el8 | All versions | 3:4.4.1-32.rhaos4.15.el8 |
podman-gvproxy Red Hat:openshift:4.15::el8 | All versions | 3:4.4.1-32.rhaos4.15.el8 |
podman-gvproxy-debuginfo Red Hat:openshift:4.15::el8 | All versions | 3:4.4.1-32.rhaos4.15.el8 |
podman-plugins Red Hat:openshift:4.15::el8 | All versions | 3:4.4.1-32.rhaos4.15.el8 |
podman-plugins-debuginfo Red Hat:openshift:4.15::el8 | All versions | 3:4.4.1-32.rhaos4.15.el8 |
podman-remote Red Hat:openshift:4.15::el8 | All versions | 3:4.4.1-32.rhaos4.15.el8 |
podman-remote-debuginfo Red Hat:openshift:4.15::el8 | All versions | 3:4.4.1-32.rhaos4.15.el8 |
podman-tests Red Hat:openshift:4.15::el8 | All versions | 3:4.4.1-32.rhaos4.15.el8 |
podman Red Hat:openshift:4.15::el9 | All versions | 3:4.4.1-32.rhaos4.15.el9 |
podman-debuginfo Red Hat:openshift:4.15::el9 | All versions | 3:4.4.1-32.rhaos4.15.el9 |
podman-debugsource Red Hat:openshift:4.15::el9 | All versions | 3:4.4.1-32.rhaos4.15.el9 |
podman-docker Red Hat:openshift:4.15::el9 | All versions | 3:4.4.1-32.rhaos4.15.el9 |
podman-gvproxy Red Hat:openshift:4.15::el9 | All versions | 3:4.4.1-32.rhaos4.15.el9 |
podman-gvproxy-debuginfo Red Hat:openshift:4.15::el9 | All versions | 3:4.4.1-32.rhaos4.15.el9 |
podman-plugins Red Hat:openshift:4.15::el9 | All versions | 3:4.4.1-32.rhaos4.15.el9 |
podman-plugins-debuginfo Red Hat:openshift:4.15::el9 | All versions | 3:4.4.1-32.rhaos4.15.el9 |
podman-remote Red Hat:openshift:4.15::el9 | All versions | 3:4.4.1-32.rhaos4.15.el9 |
podman-remote-debuginfo Red Hat:openshift:4.15::el9 | All versions | 3:4.4.1-32.rhaos4.15.el9 |
podman-tests Red Hat:openshift:4.15::el9 | All versions | 3:4.4.1-32.rhaos4.15.el9 |
aardvark-dns Red Hat:rhel_aus:8.6::appstream | All versions | 2:1.0.1-40.module+el8.6.0+22399+813f5137 |
buildah Red Hat:rhel_aus:8.6::appstream | All versions | 1:1.26.8-1.module+el8.6.0+22399+813f5137 |
buildah-debuginfo Red Hat:rhel_aus:8.6::appstream | All versions | 1:1.26.8-1.module+el8.6.0+22399+813f5137 |
buildah-debugsource Red Hat:rhel_aus:8.6::appstream | All versions | 1:1.26.8-1.module+el8.6.0+22399+813f5137 |
buildah-tests Red Hat:rhel_aus:8.6::appstream | All versions | 1:1.26.8-1.module+el8.6.0+22399+813f5137 |
buildah-tests-debuginfo Red Hat:rhel_aus:8.6::appstream | All versions | 1:1.26.8-1.module+el8.6.0+22399+813f5137 |
Products include Buildah Project Buildah, Redhat Enterprise Linux, Redhat Enterprise Linux Eus, Redhat Enterprise Linux for Arm 64, Redhat Enterprise Linux for Arm 64 Eus, Redhat Enterprise Linux for Ibm Z Systems and 8 more.
How do I fix CVE-2024-9675?
Upgrade github.com/containers/buildah to a fixed version for your release line: 1.37.1 or 1.38.0.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-9675 being exploited?
There is no known exploitation of CVE-2024-9675 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2020-10696 Path Traversal in Buildah
- CVE-2022-2990 Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification
- CVE-2022-27651 Non-empty default inheritable capabilities for linux container in Buildah
- CVE-2019-10214 containers/image library Insufficiently Protects Credentials
- CVE-2021-3602 Buildah processes using chroot isolation may leak environment values to intermediate processes
Sources
Also known as ALSA-2024:8563, AZL-110330, BELL-CVE-2024-9675, CLEANSTART-2024-MU39108, CLSA-2025-1745426658, DEBIAN-CVE-2024-9675 and 15 more.