CVE-2024-11218

Description

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.

CVSS Metrics

• v3.1•HIGH•Score: 8.6CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.36%• Percentile: 30%

Techniques & Countermeasures

• CWE-269•Improper Privilege Management

  The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Systems

• chainguard•buildah

  < 1.39.0-r2

• chainguard•podman

  < 5.3.2-r0

• chainguard•prometheus-podman-exporter

  < 1.14.0-r3

• wolfi•buildah

  < 1.39.0-r2

• wolfi•podman

  < 5.3.2-r0

• debian•golang-github-containers-buildah

  all | all | < 1.38.1+ds1-1 | < 1.38.1+ds1-1

• github.com/containers•buildah

  ≥ 1.38.0, < 1.38.1 | ≥ 1.37.0, < 1.37.6 | ≥ 1.35.0, < 1.35.5 | < 1.33.12

• redhat•aardvark-dns

  < 2:1.0.1-40.module+el8.6.0+22769+fa0fe772 | < 2:1.5.0-2.module+el8.8.0+22334+bb93e398 | < 2:1.10.1-2.module+el8.10.0+22417+2fb00970

• redhat•buildah

  < 2:1.37.6-1.el9_5 | < 1:1.26.9-1.el9_0 | < 2:1.33.12-2.el9_4 | < 1:1.26.9-2.module+el8.6.0+22769+fa0fe772 | < 1:1.29.5-1.module+el8.8.0+22779+ce927503 | < 1:1.29.5-1.el9_2 | < 2:1.33.12-1.module+el8.10.0+22744+7794713b | < 2:1.33.12-1.rhaos4.16.el8 | < 2:1.33.12-1.rhaos4.16.el9 | < 2:1.33.12-1.rhaos4.17.el8 | < 2:1.33.12-1.rhaos4.17.el9 | < 1:1.29.5-1.rhaos4.15.el8 | < 1:1.29.5-1.rhaos4.15.el9 | < 1:1.29.5-1.rhaos4.14.el8 | < 1:1.29.5-1.rhaos4.14.el9

• redhat•buildah-debuginfo

  < 2:1.37.6-1.el9_5 | < 1:1.26.9-1.el9_0 | < 2:1.33.12-2.el9_4 | < 1:1.26.9-2.module+el8.6.0+22769+fa0fe772 | < 1:1.29.5-1.module+el8.8.0+22779+ce927503 | < 1:1.29.5-1.el9_2 | < 2:1.33.12-1.module+el8.10.0+22744+7794713b | < 2:1.33.12-1.rhaos4.16.el8 | < 2:1.33.12-1.rhaos4.16.el9 | < 2:1.33.12-1.rhaos4.17.el8 | < 2:1.33.12-1.rhaos4.17.el9 | < 1:1.29.5-1.rhaos4.15.el8 | < 1:1.29.5-1.rhaos4.15.el9 | < 1:1.29.5-1.rhaos4.14.el8 | < 1:1.29.5-1.rhaos4.14.el9

• redhat•buildah-debugsource

  < 2:1.37.6-1.el9_5 | < 1:1.26.9-1.el9_0 | < 2:1.33.12-2.el9_4 | < 1:1.26.9-2.module+el8.6.0+22769+fa0fe772 | < 1:1.29.5-1.module+el8.8.0+22779+ce927503 | < 1:1.29.5-1.el9_2 | < 2:1.33.12-1.module+el8.10.0+22744+7794713b | < 2:1.33.12-1.rhaos4.16.el8 | < 2:1.33.12-1.rhaos4.16.el9 | < 2:1.33.12-1.rhaos4.17.el8 | < 2:1.33.12-1.rhaos4.17.el9 | < 1:1.29.5-1.rhaos4.15.el8 | < 1:1.29.5-1.rhaos4.15.el9 | < 1:1.29.5-1.rhaos4.14.el8 | < 1:1.29.5-1.rhaos4.14.el9

• redhat•buildah-tests

  < 2:1.37.6-1.el9_5 | < 1:1.26.9-1.el9_0 | < 2:1.33.12-2.el9_4 | < 1:1.26.9-2.module+el8.6.0+22769+fa0fe772 | < 1:1.29.5-1.module+el8.8.0+22779+ce927503 | < 1:1.29.5-1.el9_2 | < 2:1.33.12-1.module+el8.10.0+22744+7794713b | < 2:1.33.12-1.rhaos4.16.el8 | < 2:1.33.12-1.rhaos4.16.el9 | < 2:1.33.12-1.rhaos4.17.el8 | < 2:1.33.12-1.rhaos4.17.el9 | < 1:1.29.5-1.rhaos4.15.el8 | < 1:1.29.5-1.rhaos4.15.el9 | < 1:1.29.5-1.rhaos4.14.el8 | < 1:1.29.5-1.rhaos4.14.el9

• redhat•buildah-tests-debuginfo

  < 2:1.37.6-1.el9_5 | < 1:1.26.9-1.el9_0 | < 2:1.33.12-2.el9_4 | < 1:1.26.9-2.module+el8.6.0+22769+fa0fe772 | < 1:1.29.5-1.module+el8.8.0+22779+ce927503 | < 1:1.29.5-1.el9_2 | < 2:1.33.12-1.module+el8.10.0+22744+7794713b | < 2:1.33.12-1.rhaos4.16.el8 | < 2:1.33.12-1.rhaos4.16.el9 | < 2:1.33.12-1.rhaos4.17.el8 | < 2:1.33.12-1.rhaos4.17.el9 | < 1:1.29.5-1.rhaos4.15.el8 | < 1:1.29.5-1.rhaos4.15.el9 | < 1:1.29.5-1.rhaos4.14.el8 | < 1:1.29.5-1.rhaos4.14.el9

• redhat•cockpit-podman

  < 0:49.1-1.module+el8.6.0+22769+fa0fe772 | < 0:63.1-1.module+el8.8.0+22334+bb93e398 | < 0:84.1-1.module+el8.10.0+22417+2fb00970

• redhat•conmon

  < 2:2.1.4-1.module+el8.6.0+22769+fa0fe772 | < 3:2.1.6-1.module+el8.8.0+22334+bb93e398 | < 3:2.1.10-1.module+el8.10.0+22417+2fb00970

• redhat•conmon-debuginfo

  < 2:2.1.4-1.module+el8.6.0+22769+fa0fe772 | < 3:2.1.6-1.module+el8.8.0+22334+bb93e398 | < 3:2.1.10-1.module+el8.10.0+22417+2fb00970

• redhat•conmon-debugsource

  < 2:2.1.4-1.module+el8.6.0+22769+fa0fe772 | < 3:2.1.6-1.module+el8.8.0+22334+bb93e398 | < 3:2.1.10-1.module+el8.10.0+22417+2fb00970

• redhat•container-selinux

  < 2:2.189.0-1.module+el8.6.0+22769+fa0fe772 | < 2:2.229.0-1.module+el8.8.0+22334+bb93e398 | < 2:2.229.0-2.module+el8.10.0+22417+2fb00970

• redhat•containernetworking-plugins

  < 1:1.1.1-5.module+el8.6.0+22769+fa0fe772 | < 1:1.2.0-2.module+el8.8.0+22334+bb93e398 | < 1:1.4.0-5.module+el8.10.0+22417+2fb00970

• redhat•containernetworking-plugins-debuginfo

  < 1:1.1.1-5.module+el8.6.0+22769+fa0fe772 | < 1:1.2.0-2.module+el8.8.0+22334+bb93e398 | < 1:1.4.0-5.module+el8.10.0+22417+2fb00970

• redhat•containernetworking-plugins-debugsource

  < 1:1.1.1-5.module+el8.6.0+22769+fa0fe772 | < 1:1.2.0-2.module+el8.8.0+22334+bb93e398 | < 1:1.4.0-5.module+el8.10.0+22417+2fb00970

• redhat•containers-common

  < 2:1-40.module+el8.6.0+22769+fa0fe772 | < 2:1-67.module+el8.8.0+22334+bb93e398 | < 2:1-82.module+el8.10.0+22417+2fb00970

• redhat•crit

  < 0:3.15-3.module+el8.6.0+22769+fa0fe772 | < 0:3.15-4.module+el8.8.0+22334+bb93e398 | < 0:3.18-5.module+el8.10.0+22417+2fb00970

• redhat•criu

  < 0:3.15-3.module+el8.6.0+22769+fa0fe772 | < 0:3.15-4.module+el8.8.0+22334+bb93e398 | < 0:3.18-5.module+el8.10.0+22417+2fb00970

• redhat•criu-debuginfo

  < 0:3.15-3.module+el8.6.0+22769+fa0fe772 | < 0:3.15-4.module+el8.8.0+22334+bb93e398 | < 0:3.18-5.module+el8.10.0+22417+2fb00970

• redhat•criu-debugsource

  < 0:3.15-3.module+el8.6.0+22769+fa0fe772 | < 0:3.15-4.module+el8.8.0+22334+bb93e398 | < 0:3.18-5.module+el8.10.0+22417+2fb00970

• redhat•criu-devel

  < 0:3.15-3.module+el8.6.0+22769+fa0fe772 | < 0:3.15-4.module+el8.8.0+22334+bb93e398 | < 0:3.18-5.module+el8.10.0+22417+2fb00970

• redhat•criu-libs

  < 0:3.15-3.module+el8.6.0+22769+fa0fe772 | < 0:3.15-4.module+el8.8.0+22334+bb93e398 | < 0:3.18-5.module+el8.10.0+22417+2fb00970

• redhat•criu-libs-debuginfo

  < 0:3.15-3.module+el8.6.0+22769+fa0fe772 | < 0:3.15-4.module+el8.8.0+22334+bb93e398 | < 0:3.18-5.module+el8.10.0+22417+2fb00970

• redhat•crun

  < 0:1.5-1.module+el8.6.0+22769+fa0fe772 | < 0:1.8.4-2.module+el8.8.0+22334+bb93e398 | < 0:1.14.3-2.module+el8.10.0+22417+2fb00970

• redhat•crun-debuginfo

  < 0:1.5-1.module+el8.6.0+22769+fa0fe772 | < 0:1.8.4-2.module+el8.8.0+22334+bb93e398 | < 0:1.14.3-2.module+el8.10.0+22417+2fb00970

• redhat•crun-debugsource

  < 0:1.5-1.module+el8.6.0+22769+fa0fe772 | < 0:1.8.4-2.module+el8.8.0+22334+bb93e398 | < 0:1.14.3-2.module+el8.10.0+22417+2fb00970

• redhat•fuse-overlayfs

  < 0:1.9-1.module+el8.6.0+22769+fa0fe772 | < 0:1.11-1.module+el8.8.0+22334+bb93e398 | < 0:1.13-1.module+el8.10.0+22417+2fb00970

• redhat•fuse-overlayfs-debuginfo

  < 0:1.9-1.module+el8.6.0+22769+fa0fe772 | < 0:1.11-1.module+el8.8.0+22334+bb93e398 | < 0:1.13-1.module+el8.10.0+22417+2fb00970

• redhat•fuse-overlayfs-debugsource

  < 0:1.9-1.module+el8.6.0+22769+fa0fe772 | < 0:1.11-1.module+el8.8.0+22334+bb93e398 | < 0:1.13-1.module+el8.10.0+22417+2fb00970

• redhat•libslirp

  < 0:4.4.0-1.module+el8.6.0+22769+fa0fe772 | < 0:4.4.0-1.module+el8.8.0+22334+bb93e398 | < 0:4.4.0-2.module+el8.10.0+22417+2fb00970

• redhat•libslirp-debuginfo

  < 0:4.4.0-1.module+el8.6.0+22769+fa0fe772 | < 0:4.4.0-1.module+el8.8.0+22334+bb93e398 | < 0:4.4.0-2.module+el8.10.0+22417+2fb00970

• redhat•libslirp-debugsource

  < 0:4.4.0-1.module+el8.6.0+22769+fa0fe772 | < 0:4.4.0-1.module+el8.8.0+22334+bb93e398 | < 0:4.4.0-2.module+el8.10.0+22417+2fb00970

• redhat•libslirp-devel

  < 0:4.4.0-1.module+el8.6.0+22769+fa0fe772 | < 0:4.4.0-1.module+el8.8.0+22334+bb93e398 | < 0:4.4.0-2.module+el8.10.0+22417+2fb00970

• redhat•netavark

  < 2:1.0.1-40.module+el8.6.0+22769+fa0fe772 | < 2:1.5.1-3.module+el8.8.0+22334+bb93e398 | < 2:1.10.3-1.module+el8.10.0+22417+2fb00970

• redhat•oci-seccomp-bpf-hook

  < 0:1.2.6-1.module+el8.6.0+22769+fa0fe772 | < 0:1.2.8-1.module+el8.8.0+22334+bb93e398 | < 0:1.2.10-1.module+el8.10.0+22417+2fb00970

• redhat•oci-seccomp-bpf-hook-debuginfo

  < 0:1.2.6-1.module+el8.6.0+22769+fa0fe772 | < 0:1.2.8-1.module+el8.8.0+22334+bb93e398 | < 0:1.2.10-1.module+el8.10.0+22417+2fb00970

• redhat•oci-seccomp-bpf-hook-debugsource

  < 0:1.2.6-1.module+el8.6.0+22769+fa0fe772 | < 0:1.2.8-1.module+el8.8.0+22334+bb93e398 | < 0:1.2.10-1.module+el8.10.0+22417+2fb00970

• redhat•podman

  < 5:5.2.2-2.rhaos4.17.el8 | < 5:5.2.2-2.rhaos4.17.el9 | < 4:5.2.2-13.el9_5 | < 2:4.2.0-6.el9_0 | < 4:4.9.4-17.el9_4 | < 2:4.2.0-7.module+el8.6.0+22769+fa0fe772 | < 3:4.4.1-26.module+el8.8.0+22779+ce927503 | < 2:4.4.1-22.el9_2 | < 4:4.9.4-19.module+el8.10.0+22744+7794713b | < 3:4.4.1-22.rhaos4.14.el8 | < 3:4.4.1-22.rhaos4.14.el9 | < 3:4.4.1-33.rhaos4.15.el8 | < 3:4.4.1-33.rhaos4.15.el9 | < 3:4.4.1-9.rhaos4.12.el8 | < 3:4.2.0-13.rhaos4.12.el9

• redhat•podman-catatonit

  < 5:5.2.2-2.rhaos4.17.el8 | < 2:4.2.0-6.el9_0 | < 2:4.2.0-7.module+el8.6.0+22769+fa0fe772 | < 3:4.4.1-26.module+el8.8.0+22779+ce927503 | < 4:4.9.4-19.module+el8.10.0+22744+7794713b | < 3:4.4.1-22.rhaos4.14.el8 | < 3:4.4.1-33.rhaos4.15.el8 | < 3:4.4.1-9.rhaos4.12.el8 | < 3:4.2.0-13.rhaos4.12.el9

• redhat•podman-catatonit-debuginfo

  < 5:5.2.2-2.rhaos4.17.el8 | < 2:4.2.0-6.el9_0 | < 2:4.2.0-7.module+el8.6.0+22769+fa0fe772 | < 3:4.4.1-26.module+el8.8.0+22779+ce927503 | < 4:4.9.4-19.module+el8.10.0+22744+7794713b | < 3:4.4.1-22.rhaos4.14.el8 | < 3:4.4.1-33.rhaos4.15.el8 | < 3:4.4.1-9.rhaos4.12.el8 | < 3:4.2.0-13.rhaos4.12.el9

• redhat•podman-debuginfo

  < 5:5.2.2-2.rhaos4.17.el8 | < 5:5.2.2-2.rhaos4.17.el9 | < 4:5.2.2-13.el9_5 | < 2:4.2.0-6.el9_0 | < 4:4.9.4-17.el9_4 | < 2:4.2.0-7.module+el8.6.0+22769+fa0fe772 | < 3:4.4.1-26.module+el8.8.0+22779+ce927503 | < 2:4.4.1-22.el9_2 | < 4:4.9.4-19.module+el8.10.0+22744+7794713b | < 3:4.4.1-22.rhaos4.14.el8 | < 3:4.4.1-22.rhaos4.14.el9 | < 3:4.4.1-33.rhaos4.15.el8 | < 3:4.4.1-33.rhaos4.15.el9 | < 3:4.4.1-9.rhaos4.12.el8 | < 3:4.2.0-13.rhaos4.12.el9

• redhat•podman-debugsource

  < 5:5.2.2-2.rhaos4.17.el8 | < 5:5.2.2-2.rhaos4.17.el9 | < 4:5.2.2-13.el9_5 | < 2:4.2.0-6.el9_0 | < 4:4.9.4-17.el9_4 | < 2:4.2.0-7.module+el8.6.0+22769+fa0fe772 | < 3:4.4.1-26.module+el8.8.0+22779+ce927503 | < 2:4.4.1-22.el9_2 | < 4:4.9.4-19.module+el8.10.0+22744+7794713b | < 3:4.4.1-22.rhaos4.14.el8 | < 3:4.4.1-22.rhaos4.14.el9 | < 3:4.4.1-33.rhaos4.15.el8 | < 3:4.4.1-33.rhaos4.15.el9 | < 3:4.4.1-9.rhaos4.12.el8 | < 3:4.2.0-13.rhaos4.12.el9

• redhat•podman-docker

  < 5:5.2.2-2.rhaos4.17.el8 | < 5:5.2.2-2.rhaos4.17.el9 | < 4:5.2.2-13.el9_5 | < 2:4.2.0-6.el9_0 | < 4:4.9.4-17.el9_4 | < 2:4.2.0-7.module+el8.6.0+22769+fa0fe772 | < 3:4.4.1-26.module+el8.8.0+22779+ce927503 | < 2:4.4.1-22.el9_2 | < 4:4.9.4-19.module+el8.10.0+22744+7794713b | < 3:4.4.1-22.rhaos4.14.el8 | < 3:4.4.1-22.rhaos4.14.el9 | < 3:4.4.1-33.rhaos4.15.el8 | < 3:4.4.1-33.rhaos4.15.el9 | < 3:4.4.1-9.rhaos4.12.el8 | < 3:4.2.0-13.rhaos4.12.el9

• redhat•podman-gvproxy

  < 5:5.2.2-2.rhaos4.17.el8 | < 2:4.2.0-6.el9_0 | < 2:4.2.0-7.module+el8.6.0+22769+fa0fe772 | < 3:4.4.1-26.module+el8.8.0+22779+ce927503 | < 2:4.4.1-22.el9_2 | < 4:4.9.4-19.module+el8.10.0+22744+7794713b | < 3:4.4.1-22.rhaos4.14.el8 | < 3:4.4.1-22.rhaos4.14.el9 | < 3:4.4.1-33.rhaos4.15.el8 | < 3:4.4.1-33.rhaos4.15.el9 | < 3:4.4.1-9.rhaos4.12.el8 | < 3:4.2.0-13.rhaos4.12.el9

Showing first 50 affected entries in server-rendered view.

References (63)

• https://access.redhat.com/errata/RHSA-2025:0830
• https://access.redhat.com/errata/RHSA-2025:0878
• https://access.redhat.com/errata/RHSA-2025:0922
• https://access.redhat.com/errata/RHSA-2025:0923
• https://access.redhat.com/errata/RHSA-2025:1186
• https://access.redhat.com/errata/RHSA-2025:1187
• https://access.redhat.com/errata/RHSA-2025:1188
• https://access.redhat.com/errata/RHSA-2025:1189
• https://access.redhat.com/errata/RHSA-2025:1207
• https://access.redhat.com/errata/RHSA-2025:1275
• https://access.redhat.com/errata/RHSA-2025:1295
• https://access.redhat.com/errata/RHSA-2025:1296
• https://access.redhat.com/errata/RHSA-2025:1372
• https://access.redhat.com/errata/RHSA-2025:1453
• https://access.redhat.com/errata/RHSA-2025:1707
• https://access.redhat.com/errata/RHSA-2025:1713
• https://access.redhat.com/errata/RHSA-2025:1908
• https://access.redhat.com/errata/RHSA-2025:1910
• https://access.redhat.com/errata/RHSA-2025:1914
• https://access.redhat.com/errata/RHSA-2025:2441
• https://access.redhat.com/errata/RHSA-2025:2443
• https://access.redhat.com/errata/RHSA-2025:2454
• https://access.redhat.com/errata/RHSA-2025:2456
• https://access.redhat.com/errata/RHSA-2025:2701
• https://access.redhat.com/errata/RHSA-2025:2703
• https://access.redhat.com/errata/RHSA-2025:2710
• https://access.redhat.com/errata/RHSA-2025:2712
• https://access.redhat.com/errata/RHSA-2025:3577
• https://access.redhat.com/errata/RHSA-2025:3798
• https://access.redhat.com/security/cve/CVE-2024-11218
• https://bugzilla.redhat.com/show_bug.cgi?id=2326231
• https://github.com/containers/buildah/pull/5918
• https://github.com/containers/buildah/security/advisories/GHSA-5vpc-35f4-r8w6
• https://nvd.nist.gov/vuln/detail/CVE-2024-11218
• https://github.com/containers/buildah
• https://issues.redhat.com/browse/RHEL-67616
• https://issues.redhat.com/browse/RHEL-67618
• https://access.redhat.com/security/updates/classification/#important
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0878.json
• https://www.cve.org/CVERecord?id=CVE-2024-11218
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0922.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0923.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1186.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1187.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1188.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1189.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1207.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1275.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1295.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1296.json
• https://issues.redhat.com/browse/RHEL-74865
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1372.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1453.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1713.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1910.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1914.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2443.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2456.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2712.json
• https://security-tracker.debian.org/tracker/CVE-2024-11218
• https://access.redhat.com/downloads/content/package-browser/
• https://catalog.redhat.com/software/containers/
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11218.json