CVE-2024-9407: Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-01 · updated 2026-10-22
Weakness: CWE-20

Description

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

Affected products

Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 8: all versions — fixed in 8100020241023085649.afee755d
Red Hat Enterprise Linux 9: all versions — fixed in 2:1.37.5-1.el9_5, 4:4.9.4-16.el9_4, 4:5.2.2-9.el9_5
Red Hat Enterprise Linux 9.4 Extended Update Support: all versions — fixed in 2:1.33.11-1.el9_4
Red Hat OpenShift Container Platform 4.16: all versions — fixed in 416.94.202411201433-0

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 8 8100020241023085649.afee755d; Red Hat Enterprise Linux 9 2:1.37.5-1.el9_5, 4:4.9.4-16.el9_4, 4:5.2.2-9.el9_5; Red Hat Enterprise Linux 9.4 Extended Update Support 2:1.33.11-1.el9_4; Red Hat OpenShift Container Platform 4.16 416.94.202411201433-0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-9407 or the next vulnerability affects your stack