4.7

CVE-2024-9407: Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction

Deferred
AliasesUBUNTU-CVE-2024-9407DEBIAN-CVE-2024-9407CGA-7p78-w57f-h249
Published 01-10-2024Last modified 22-10-2026

Vulnerability summary

CVE-2024-9407 is a medium (CVSS 4.7) Improper Input Validation vulnerability in buildah. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 21.3% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 4.7, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
4.7/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.29%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 22 · Related 19
MGASA-2024-0343OPENSUSE-SU-2024:0350-1OPENSUSE-SU-2024:14388-1OPENSUSE-SU-2024:14390-1OPENSUSE-SU-2024:14447-1RHSA-2024:8846

Timeline

  1. 01-10-2024
    PublishedVulnerability first disclosed.
  2. 22-10-2026
    Last modifiedVulnerability information updated.

Description

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

CVSS metrics

9 scores · 8 sources · 2 versions

EPSS trend

Probability

0.29%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.29% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Github.com/containers/podman4 products
  • v2< 5.2.4 | All versions (No fix recorded)
  • v3< 5.2.4 | All versions (No fix recorded)
  • v4< 5.2.4 | All versions (No fix recorded)
  • v5< 5.2.4
Chainguard3 products
  • buildah< 1.39.0-r2
  • podmanAll versions (No fix recorded)
  • podman-docAll versions (No fix recorded)
Wolfi3 products
  • buildah< 1.39.0-r2
  • podmanAll versions (No fix recorded)
  • podman-docAll versions (No fix recorded)
Alpine2 products
  • buildah< 1.37.4-r0
  • podman< 5.2.4-r0
Github.com/containers2 products
  • buildah< 1.37.4
  • podman< 5.2.4 | All versions (No fix recorded)
Debian1 product
  • golang-github-containers-buildahAll versions (No fix recorded) | < 1.37.4+ds1-1
Ubuntu1 product
  • golang-github-containers-buildahAll versions (No fix recorded)

7 vendors · 16 products

References

24 links
Show all 24 references