Skip to content
Fencer Vulns
medium 4.7

CVE-2024-9407 json

Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction

published 2024-10-01 2 y ago modified 2026-11-05 3 d ago also GHSA-fhqq-8f65-5xfc , GO-2024-3169 , EUVD-2024-3036

cvss
4.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

Patch / fix

  • go github.com/containers/buildah 1.37.4
  • go github.com/containers/podman/v5 5.2.4
  • go github.com/containers/podman 5.2.4
  • go github.com/containers/podman/v2 5.2.4
  • go github.com/containers/podman/v3 5.2.4
  • go github.com/containers/podman/v4 5.2.4
  • Red Hat Red Hat Enterprise Linux 8 8100020241023085649.afee755d
  • Red Hat Red Hat Enterprise Linux 9 2:1.37.5-1.el9_5, 4:4.9.4-16.el9_4, 4:5.2.2-9.el9_5
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 2:1.33.11-1.el9_4
  • Red Hat Red Hat OpenShift Container Platform 4.16 416.94.202411201433-0
  • golang-github-containers-buildah Debian 14, Debian 13 1.37.4+ds1-1

debian advisories DEBIAN-CVE-2024-9407

  • podman RHEL 9 4:4.9.4-16.el9_4
  • podman-tests RHEL 9 4:4.9.4-16.el9_4
  • podman-docker RHEL 9 4:4.9.4-16.el9_4
  • podman-remote RHEL 9 4:4.9.4-16.el9_4
  • podman-plugins RHEL 9 4:4.9.4-16.el9_4
  • buildah RHEL 9 2:1.37.5-1.el9_5
  • buildah-tests RHEL 9 2:1.37.5-1.el9_5
  • podman RHEL 9 4:5.2.2-9.el9_5

red hat advisories RHSA-2024:9926RHSA-2024:9051RHSA-2024:9459RHSA-2024:9454RHSA-2024:8846

  • podman Linux Micro 6.1 5.2.5-slfo.1.1_1.1
  • podman Linux Micro 6.0 4.9.5-3.1
  • podman SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +3 more 4.9.5-150300.9.43.1
  • podman Linux Micro 6.0 4.9.5-2.1
  • buildah SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 1.35.5-150300.8.31.2
  • buildah SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 1.35.5-150400.3.36.1
  • podman SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 4.9.5-150400.4.35.1
  • buildah SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 1.35.4-150300.8.28.3

suse advisories SUSE-SU-2025:20279-1SUSE-SU-2025:20143-1SUSE-SU-2025:0775-1SUSE-SU-2025:20080-1SUSE-SU-2025:0320-1SUSE-SU-2025:0319-1

  • govulncheck-vulndb Package Hub 12 0.0.20241104T154416-5.1
  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20241030T212825-1.1
  • buildah openSUSE Tumbleweed 1.37.4-1.1
  • podman openSUSE Tumbleweed 5.2.4-1.1

opensuse advisories openSUSE-SU-2024:0350-1openSUSE-SU-2024:14447-1openSUSE-SU-2024:14388-1openSUSE-SU-2024:14390-1

  • podman AlmaLinux 9 4:5.2.2-9.el9_5
  • podman-tests AlmaLinux 9 4:5.2.2-9.el9_5
  • podman-docker AlmaLinux 9 4:5.2.2-9.el9_5
  • podman-remote AlmaLinux 9 4:5.2.2-9.el9_5
  • podman-plugins AlmaLinux 9 4:5.2.2-9.el9_5
  • buildah AlmaLinux 9 2:1.37.5-1.el9_5
  • buildah-tests AlmaLinux 9 2:1.37.5-1.el9_5
  • podman AlmaLinux 9 4:4.9.4-16.el9_4

almalinux advisories ALSA-2024:9454ALSA-2024:9459ALSA-2024:9051ALSA-2024:8846

  • podman Rocky Linux 9 4:4.9.4-16.el9_4
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1815+5fe7415e
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1815+5fe7415e
  • runc Rocky Linux 8 1:1.1.12-5.module+el8.10.0+1874+ce489889
  • udica Rocky Linux 8 0.2.6-21.module+el8.10.0+1815+5fe7415e
  • conmon Rocky Linux 8 3:2.1.10-1.module+el8.10.0+1815+5fe7415e
  • podman Rocky Linux 8 4:4.9.4-15.module+el8.10.0+1880+8e896d1b
  • skopeo Rocky Linux 8 2:1.14.5-3.module+el8.10.0+1843+6892ab28

rocky linux advisories RLSA-2024:9051RLSA-2024:8846

  • podman Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 5.2.4-r0
  • buildah Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 1.37.4-r0

alpine advisories ALPINE-CVE-2024-9407

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • podman Azure Linux 3.0 5.6.1-2

azure linux advisories AZL-50262

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-9407 updated cvss 4.7

Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction

  • Red Hat Enterprise Linux 10 podman, buildah
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 openshift4/ose-docker-builder
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.18-5.module+el8.10.0+22397+e3c95ba6, criu 3.18-5.module+el8.10.0+22397+e3c95ba6, crun 1.14.3-2.module+el8.10.0+22397+e3c95ba6, runc 1.1.12-5.module+el8.10.0+22397+e3c95ba6, udica 0.2.6-21.module+el8.10.0+22397+e3c95ba6, conmon 2.1.10-1.module+el8.10.0+22397+e3c95ba6, +27 more
    fixed: vendor fix RHSA-2024:8846
  • Red Hat Enterprise Linux AppStream (v. 9) podman 5.2.2-9.el9_5, podman 4.9.4-16.el9_4, buildah 1.37.5-1.el9_5, podman-tests 5.2.2-9.el9_5, podman-docker 5.2.2-9.el9_5, podman-remote 5.2.2-9.el9_5, +6 more
    fixed: vendor fix RHSA-2024:9051
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) buildah 1.33.11-1.el9_4, buildah-tests 1.33.11-1.el9_4
    fixed: vendor fix RHSA-2024:9926
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202411201433-0
    fixed: vendor fix RHSA-2024:10147
  • Red Hat OpenShift Container Platform 4 buildah, buildah-tests Red Hat OpenShift Container Platform 4.16 openshift4/ose-cli-rhel9 v4.16.0-202411190033.p0.gcf533b5.assembly.stream.el9, openshift4/ose-pod-rhel9 v4.16.0-202411200234.p0.g67d3387.assembly.stream.el9, openshift4/ose-sdn-rhel9 v4.16.0-202411200234.p0.gc4dd04f.assembly.stream.el9, openshift4/ose-etcd-rhel9 v4.16.0-202411190033.p0.g16202ec.assembly.stream.el9, openshift4/ose-tests-rhel9 v4.16.0-202411211035.p0.gc740dbd.assembly.stream.el9, openshift4/ose-tools-rhel9 v4.16.0-202411190033.p0.gcf533b5.assembly.stream.el9, +185 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N
GitHub 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
go github.com/containers/buildah
<1.37.4
1.37.4
go github.com/containers/podman/v5
<5.2.4
5.2.4
go github.com/containers/podman
<5.2.4
all versions
5.2.4
go github.com/containers/podman/v2
<5.2.4
all versions
5.2.4
go github.com/containers/podman/v3
<5.2.4
all versions
5.2.4
go github.com/containers/podman/v4
<5.2.4
all versions
5.2.4

Affected products

  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.