CVE-2024-11218

Aliases:GHSA-5vpc-35f4-r8w6GO-2025-3414
Advisory lineage Upstream: 0 Downstream: 35
Deferred
Published: 22 Jan 2025, 04:55
Last modified:29 Apr 2026, 07:53

Vulnerability Summary

Overall Risk (default)
medium
34/100
CVSS Score
8.6 HIGH
v3.1 (cve.org)
EPSS Score
0.17% LOW
0% probability +0.10%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

22 Jan 2025, 04:55
Published
Vulnerability first disclosed
29 Apr 2026, 07:53
Last Modified
Vulnerability information updated

Description

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.

CVSS Metrics

  • v3.1•HIGH•Score: 8.6CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.17%• Percentile: 37%

Techniques & Countermeasures

  • CWE-269•Improper Privilege Management

    The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Systems

  • github.com/containers•buildah

    ≥ 1.37.0, < 1.37.6 | ≥ 1.35.0, < 1.35.5 | < 1.33.12 | ≥ 1.38.0, < 1.38.1

References (37)