CVE-2024-11218: Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-22 · updated 2026-10-30
Weakness: CWE-269

Description

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.

Affected products

buildah: before 1.33.12; from 1.35.0 before 1.35.5; from 1.37.0 before 1.37.6; from 1.38.0 before 1.38.1 — fixed in 1.33.12, 1.35.5, 1.37.6, 1.38.1
Red Hat OpenShift Container Platform 4.18: all versions — fixed in 2:1.33.7-4.rhaos4.18.el9
Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 8: all versions — fixed in 8100020250124120243.afee755d
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: all versions — fixed in 8060020250203202123.3b538bd8
Red Hat Enterprise Linux 8.6 Telecommunications Update Service: all versions — fixed in 8060020250203202123.3b538bd8
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions: all versions — fixed in 8060020250203202123.3b538bd8
Red Hat Enterprise Linux 8.8 Extended Update Support: all versions — fixed in 8080020250207173112.0f77c1b7
Red Hat Enterprise Linux 9: all versions — fixed in 4:5.2.2-13.el9_5
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions: all versions — fixed in 2:4.2.0-6.el9_0
Red Hat Enterprise Linux 9.2 Extended Update Support: all versions — fixed in 1:1.29.5-1.el9_2
Red Hat Enterprise Linux 9.4 Extended Update Support: all versions — fixed in 2:1.33.12-2.el9_4
Red Hat OpenShift Container Platform 4.12: all versions — fixed in 412.86.202503052321-0
Red Hat OpenShift Container Platform 4.13: all versions — fixed in 1:1.29.5-1.rhaos4.13.el8
Red Hat OpenShift Container Platform 4.14: all versions — fixed in 3:4.4.1-22.rhaos4.14.el8
Red Hat OpenShift Container Platform 4.15: all versions — fixed in 3:4.4.1-33.rhaos4.15.el8
Red Hat OpenShift Container Platform 4.16: all versions — fixed in 4:4.9.4-13.rhaos4.16.el8
Red Hat OpenShift Container Platform 4.17: all versions — fixed in 5:5.2.2-2.rhaos4.17.el8

How to fix

Upgrade to a fixed version: buildah 1.33.12, 1.35.5, 1.37.6, 1.38.1; Red Hat OpenShift Container Platform 4.18 2:1.33.7-4.rhaos4.18.el9; Red Hat Enterprise Linux 8 8100020250124120243.afee755d; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020250203202123.3b538bd8; Red Hat Enterprise Linux 8.6 Telecommunications Update Service 8060020250203202123.3b538bd8; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 8060020250203202123.3b538bd8; Red Hat Enterprise Linux 8.8 Extended Update Support 8080020250207173112.0f77c1b7; Red Hat Enterprise Linux 9 4:5.2.2-13.el9_5; Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 2:4.2.0-6.el9_0; Red Hat Enterprise Linux 9.2 Extended Update Support 1:1.29.5-1.el9_2; Red Hat Enterprise Linux 9.4 Extended Update Support 2:1.33.12-2.el9_4; Red Hat OpenShift Container Platform 4.12 412.86.202503052321-0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-11218 or the next vulnerability affects your stack