CVSS 3.1
8.6 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HCVE-2024-1753
High (8.6). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/containers/podman/v4 4.9.4.
A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
- CWE
- CWE-59
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-874v-pj72-92f3 | Go | github.com/containers/podman/v4 | <4.9.4 | 4.9.4 |
| GHSA-874v-pj72-92f3 | Go | github.com/containers/podman/v5 | <5.0.1 | 5.0.1 |
| GHSA-pmf3-c36m-g5cf | Go | github.com/containers/buildah | >=1.35.0 <1.35.1 | 1.35.1 |
| GHSA-pmf3-c36m-g5cf | Go | github.com/containers/buildah | >=1.34.0 <1.34.3 | 1.34.3 |
| GHSA-pmf3-c36m-g5cf | Go | github.com/containers/buildah | >=1.33.0 <1.33.7 | 1.33.7 |
| GHSA-pmf3-c36m-g5cf | Go | github.com/containers/buildah | >=1.25.0 <1.27.4 | 1.27.4 |
| GHSA-pmf3-c36m-g5cf | Go | github.com/containers/buildah | >=1.24.0 <1.24.7 | 1.24.7 |
| GHSA-pmf3-c36m-g5cf | Go | github.com/containers/buildah | >=1.28.0 <1.29.3 | 1.29.3 |
| GHSA-pmf3-c36m-g5cf | Go | github.com/containers/buildah | >=1.30.0 <1.31.5 | 1.31.5 |
| GHSA-pmf3-c36m-g5cf | Go | github.com/containers/buildah | >=1.32.0 <1.32.3 | 1.32.3 |
| GO-2024-2658 | Go | github.com/containers/buildah | <1.35.1 | 1.35.1 |