CVE-2024-9675: Buildah: buildah allows arbitrary directory mount

Modified

AliasesSUSE-SU-2024:3728-1RHSA-2024:8563RHSA-2024:8675+17 more

Published 09-10-2024Last modified 01-11-2026

Vulnerability summary

CVE-2024-9675 is a high (CVSS 7.8) vulnerability in buildah_project buildah. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 33.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v3.1 (CVE.org)

EPSS score

0.39%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

09-10-2024
PublishedVulnerability first disclosed.
01-11-2026
Last modifiedVulnerability information updated.

Description

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

CVSS metrics

10 scores · 9 sources · 2 versions

v4.05.3v3.17.8

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

33%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.39% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat80 products

enterprise_linux8.0 | 9.0
enterprise_linux_eus8.8 | 9.0 | 9.2 | 9.4
enterprise_linux_for_arm_648.0_aarch64 | 9.0_aarch64
enterprise_linux_for_arm_64_eus8.8_aarch64 | 9.0_aarch64 | 9.2_aarch64 | 9.4_aarch64
enterprise_linux_for_ibm_z_systems8.0_s390x | 9.0_s390x

enterprise_linux_for_ibm_z_systems_eus8.8_s390x | 9.0_s390x | 9.2_s390x | 9.4_s390x
enterprise_linux_for_power_little_endian8.0_ppc64le | 9.0_ppc64le
enterprise_linux_for_power_little_endian_eus8.8_ppc64le | 9.0_ppc64le | 9.2_ppc64le | 9.4_ppc64le
enterprise_linux_server_aus8.6 | 9.2 | 9.4
enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions8.6_ppc64le | 8.8_ppc64le | 9.0_ppc64le | 9.2_ppc64le | 9.4_ppc64le
enterprise_linux_server_tus8.6 | 8.8
enterprise_linux_update_services_for_sap_solutions8.6 | 8.8 | 9.0 | 9.2 | 9.4
openshift_container_platform4.13 | 4.14 | 4.15 | 4.16 | 4.17
aardvark-dns< 2:1.0.1-40.module+el8.6.0+22399+813f5137 | < 2:1.5.0-2.module+el8.8.0+22334+bb93e398
buildah< 2:1.33.10-1.el9_4 | < 1:1.26.8-2.el9_0 | < 1:1.26.8-1.module+el8.6.0+22399+813f5137 | < 1:1.29.4-1.module+el8.8.0+22398+6ad0f5ed | < 1:1.29.4-1.el9_2
buildah-debuginfo< 2:1.33.10-1.el9_4 | < 1:1.26.8-2.el9_0 | < 1:1.26.8-1.module+el8.6.0+22399+813f5137 | < 1:1.29.4-1.module+el8.8.0+22398+6ad0f5ed | < 1:1.29.4-1.el9_2
buildah-debugsource< 2:1.33.10-1.el9_4 | < 1:1.26.8-2.el9_0 | < 1:1.26.8-1.module+el8.6.0+22399+813f5137 | < 1:1.29.4-1.module+el8.8.0+22398+6ad0f5ed | < 1:1.29.4-1.el9_2
buildah-tests< 2:1.33.10-1.el9_4 | < 1:1.26.8-2.el9_0 | < 1:1.26.8-1.module+el8.6.0+22399+813f5137 | < 1:1.29.4-1.module+el8.8.0+22398+6ad0f5ed | < 1:1.29.4-1.el9_2
buildah-tests-debuginfo< 2:1.33.10-1.el9_4 | < 1:1.26.8-2.el9_0 | < 1:1.26.8-1.module+el8.6.0+22399+813f5137 | < 1:1.29.4-1.module+el8.8.0+22398+6ad0f5ed | < 1:1.29.4-1.el9_2
cockpit-podman< 0:49.1-1.module+el8.6.0+22399+813f5137 | < 0:63.1-1.module+el8.8.0+22334+bb93e398
conmon< 2:2.1.4-1.module+el8.6.0+22399+813f5137 | < 3:2.1.6-1.module+el8.8.0+22334+bb93e398
conmon-debuginfo< 2:2.1.4-1.module+el8.6.0+22399+813f5137 | < 3:2.1.6-1.module+el8.8.0+22334+bb93e398
conmon-debugsource< 2:2.1.4-1.module+el8.6.0+22399+813f5137 | < 3:2.1.6-1.module+el8.8.0+22334+bb93e398
container-selinux< 2:2.189.0-1.module+el8.6.0+22399+813f5137 | < 2:2.229.0-1.module+el8.8.0+22334+bb93e398
containernetworking-plugins< 1:1.1.1-5.module+el8.6.0+22399+813f5137 | < 1:1.2.0-2.module+el8.8.0+22334+bb93e398
containernetworking-plugins-debuginfo< 1:1.1.1-5.module+el8.6.0+22399+813f5137 | < 1:1.2.0-2.module+el8.8.0+22334+bb93e398
containernetworking-plugins-debugsource< 1:1.1.1-5.module+el8.6.0+22399+813f5137 | < 1:1.2.0-2.module+el8.8.0+22334+bb93e398
containers-common< 2:1-40.module+el8.6.0+22399+813f5137 | < 2:1-67.module+el8.8.0+22334+bb93e398
crit< 0:3.15-3.module+el8.6.0+22399+813f5137 | < 0:3.15-4.module+el8.8.0+22334+bb93e398
criu< 0:3.15-3.module+el8.6.0+22399+813f5137 | < 0:3.15-4.module+el8.8.0+22334+bb93e398
criu-debuginfo< 0:3.15-3.module+el8.6.0+22399+813f5137 | < 0:3.15-4.module+el8.8.0+22334+bb93e398
criu-debugsource< 0:3.15-3.module+el8.6.0+22399+813f5137 | < 0:3.15-4.module+el8.8.0+22334+bb93e398
criu-devel< 0:3.15-3.module+el8.6.0+22399+813f5137 | < 0:3.15-4.module+el8.8.0+22334+bb93e398
criu-libs< 0:3.15-3.module+el8.6.0+22399+813f5137 | < 0:3.15-4.module+el8.8.0+22334+bb93e398
criu-libs-debuginfo< 0:3.15-3.module+el8.6.0+22399+813f5137 | < 0:3.15-4.module+el8.8.0+22334+bb93e398
crun< 0:1.5-1.module+el8.6.0+22399+813f5137 | < 0:1.8.4-2.module+el8.8.0+22334+bb93e398
crun-debuginfo< 0:1.5-1.module+el8.6.0+22399+813f5137 | < 0:1.8.4-2.module+el8.8.0+22334+bb93e398
crun-debugsource< 0:1.5-1.module+el8.6.0+22399+813f5137 | < 0:1.8.4-2.module+el8.8.0+22334+bb93e398
fuse-overlayfs< 0:1.9-1.module+el8.6.0+22399+813f5137 | < 0:1.11-1.module+el8.8.0+22334+bb93e398
fuse-overlayfs-debuginfo< 0:1.9-1.module+el8.6.0+22399+813f5137 | < 0:1.11-1.module+el8.8.0+22334+bb93e398
fuse-overlayfs-debugsource< 0:1.9-1.module+el8.6.0+22399+813f5137 | < 0:1.11-1.module+el8.8.0+22334+bb93e398
libslirp< 0:4.4.0-1.module+el8.6.0+22399+813f5137 | < 0:4.4.0-1.module+el8.8.0+22334+bb93e398
libslirp-debuginfo< 0:4.4.0-1.module+el8.6.0+22399+813f5137 | < 0:4.4.0-1.module+el8.8.0+22334+bb93e398
libslirp-debugsource< 0:4.4.0-1.module+el8.6.0+22399+813f5137 | < 0:4.4.0-1.module+el8.8.0+22334+bb93e398
libslirp-devel< 0:4.4.0-1.module+el8.6.0+22399+813f5137 | < 0:4.4.0-1.module+el8.8.0+22334+bb93e398
netavark< 2:1.0.1-40.module+el8.6.0+22399+813f5137 | < 2:1.5.1-3.module+el8.8.0+22334+bb93e398
oci-seccomp-bpf-hook< 0:1.2.6-1.module+el8.6.0+22399+813f5137 | < 0:1.2.8-1.module+el8.8.0+22334+bb93e398
oci-seccomp-bpf-hook-debuginfo< 0:1.2.6-1.module+el8.6.0+22399+813f5137 | < 0:1.2.8-1.module+el8.8.0+22334+bb93e398
oci-seccomp-bpf-hook-debugsource< 0:1.2.6-1.module+el8.6.0+22399+813f5137 | < 0:1.2.8-1.module+el8.8.0+22334+bb93e398
podman< 3:4.4.1-32.rhaos4.15.el8 | < 3:4.4.1-32.rhaos4.15.el9 | < 2:4.2.0-5.el9_0.2 | < 2:4.2.0-5.module+el8.6.0+22399+813f5137 | < 3:4.4.1-25.module+el8.8.0+22398+6ad0f5ed | < 2:4.4.1-21.el9_2
podman-catatonit< 3:4.4.1-32.rhaos4.15.el8 | < 2:4.2.0-5.el9_0.2 | < 2:4.2.0-5.module+el8.6.0+22399+813f5137 | < 3:4.4.1-25.module+el8.8.0+22398+6ad0f5ed
podman-catatonit-debuginfo< 3:4.4.1-32.rhaos4.15.el8 | < 2:4.2.0-5.el9_0.2 | < 2:4.2.0-5.module+el8.6.0+22399+813f5137 | < 3:4.4.1-25.module+el8.8.0+22398+6ad0f5ed
podman-debuginfo< 3:4.4.1-32.rhaos4.15.el8 | < 3:4.4.1-32.rhaos4.15.el9 | < 2:4.2.0-5.el9_0.2 | < 2:4.2.0-5.module+el8.6.0+22399+813f5137 | < 3:4.4.1-25.module+el8.8.0+22398+6ad0f5ed | < 2:4.4.1-21.el9_2
podman-debugsource< 3:4.4.1-32.rhaos4.15.el8 | < 3:4.4.1-32.rhaos4.15.el9 | < 2:4.2.0-5.el9_0.2 | < 2:4.2.0-5.module+el8.6.0+22399+813f5137 | < 3:4.4.1-25.module+el8.8.0+22398+6ad0f5ed | < 2:4.4.1-21.el9_2
podman-docker< 3:4.4.1-32.rhaos4.15.el8 | < 3:4.4.1-32.rhaos4.15.el9 | < 2:4.2.0-5.el9_0.2 | < 2:4.2.0-5.module+el8.6.0+22399+813f5137 | < 3:4.4.1-25.module+el8.8.0+22398+6ad0f5ed | < 2:4.4.1-21.el9_2
podman-gvproxy< 3:4.4.1-32.rhaos4.15.el8 | < 3:4.4.1-32.rhaos4.15.el9 | < 2:4.2.0-5.el9_0.2 | < 2:4.2.0-5.module+el8.6.0+22399+813f5137 | < 3:4.4.1-25.module+el8.8.0+22398+6ad0f5ed | < 2:4.4.1-21.el9_2
podman-gvproxy-debuginfo< 3:4.4.1-32.rhaos4.15.el8 | < 3:4.4.1-32.rhaos4.15.el9 | < 2:4.2.0-5.el9_0.2 | < 2:4.2.0-5.module+el8.6.0+22399+813f5137 | < 3:4.4.1-25.module+el8.8.0+22398+6ad0f5ed | < 2:4.4.1-21.el9_2
podman-plugins< 3:4.4.1-32.rhaos4.15.el8 | < 3:4.4.1-32.rhaos4.15.el9 | < 2:4.2.0-5.el9_0.2 | < 2:4.2.0-5.module+el8.6.0+22399+813f5137 | < 3:4.4.1-25.module+el8.8.0+22398+6ad0f5ed | < 2:4.4.1-21.el9_2
podman-plugins-debuginfo< 3:4.4.1-32.rhaos4.15.el8 | < 3:4.4.1-32.rhaos4.15.el9 | < 2:4.2.0-5.el9_0.2 | < 2:4.2.0-5.module+el8.6.0+22399+813f5137 | < 3:4.4.1-25.module+el8.8.0+22398+6ad0f5ed | < 2:4.4.1-21.el9_2
podman-remote< 3:4.4.1-32.rhaos4.15.el8 | < 3:4.4.1-32.rhaos4.15.el9 | < 2:4.2.0-5.el9_0.2 | < 2:4.2.0-5.module+el8.6.0+22399+813f5137 | < 3:4.4.1-25.module+el8.8.0+22398+6ad0f5ed | < 2:4.4.1-21.el9_2
podman-remote-debuginfo< 3:4.4.1-32.rhaos4.15.el8 | < 3:4.4.1-32.rhaos4.15.el9 | < 2:4.2.0-5.el9_0.2 | < 2:4.2.0-5.module+el8.6.0+22399+813f5137 | < 3:4.4.1-25.module+el8.8.0+22398+6ad0f5ed | < 2:4.4.1-21.el9_2
podman-tests< 3:4.4.1-32.rhaos4.15.el8 | < 3:4.4.1-32.rhaos4.15.el9 | < 2:4.2.0-5.el9_0.2 | < 2:4.2.0-5.module+el8.6.0+22399+813f5137 | < 3:4.4.1-25.module+el8.8.0+22398+6ad0f5ed | < 2:4.4.1-21.el9_2
python-podman< 0:4.0.1-1.module+el8.6.0+22399+813f5137 | < 0:4.4.1-1.module+el8.8.0+22334+bb93e398
python3-criu< 0:3.15-3.module+el8.6.0+22399+813f5137 | < 0:3.15-4.module+el8.8.0+22334+bb93e398
python3-podman< 0:4.0.1-1.module+el8.6.0+22399+813f5137 | < 0:4.4.1-1.module+el8.8.0+22334+bb93e398
runc< 1:1.1.12-1.module+el8.6.0+22399+813f5137 | < 1:1.1.12-1.module+el8.8.0+22334+bb93e398
runc-debuginfo< 1:1.1.12-1.module+el8.6.0+22399+813f5137 | < 1:1.1.12-1.module+el8.8.0+22334+bb93e398
runc-debugsource< 1:1.1.12-1.module+el8.6.0+22399+813f5137 | < 1:1.1.12-1.module+el8.8.0+22334+bb93e398
skopeo< 2:1.9.1-2.module+el8.6.0+22399+813f5137 | < 2:1.11.2-0.3.module+el8.8.0+22334+bb93e398
skopeo-debuginfo< 2:1.9.1-2.module+el8.6.0+22399+813f5137
skopeo-debugsource< 2:1.9.1-2.module+el8.6.0+22399+813f5137
skopeo-tests< 2:1.9.1-2.module+el8.6.0+22399+813f5137 | < 2:1.11.2-0.3.module+el8.8.0+22334+bb93e398
slirp4netns< 0:1.2.0-3.module+el8.6.0+22399+813f5137 | < 0:1.2.0-3.module+el8.8.0+22334+bb93e398
slirp4netns-debuginfo< 0:1.2.0-3.module+el8.6.0+22399+813f5137 | < 0:1.2.0-3.module+el8.8.0+22334+bb93e398
slirp4netns-debugsource< 0:1.2.0-3.module+el8.6.0+22399+813f5137 | < 0:1.2.0-3.module+el8.8.0+22334+bb93e398
toolbox< 0:0.0.99.3-0.7.module+el8.6.0+22399+813f5137 | < 0:0.0.99.3-7.module+el8.8.0+22334+bb93e398
toolbox-debuginfo< 0:0.0.99.3-0.7.module+el8.6.0+22399+813f5137 | < 0:0.0.99.3-7.module+el8.8.0+22334+bb93e398
toolbox-debugsource< 0:0.0.99.3-0.7.module+el8.6.0+22399+813f5137 | < 0:0.0.99.3-7.module+el8.8.0+22334+bb93e398
toolbox-tests< 0:0.0.99.3-0.7.module+el8.6.0+22399+813f5137 | < 0:0.0.99.3-7.module+el8.8.0+22334+bb93e398
udica< 0:0.2.6-5.module+el8.6.0+22399+813f5137 | < 0:0.2.6-20.module+el8.8.0+22334+bb93e398

Show all 80

Opensuse4 products

buildah&distro=openSUSE Leap 15.5< 1.35.4-150500.3.16.1
buildah&distro=openSUSE Leap 15.6< 1.35.4-150500.3.16.1
buildah&distro=openSUSE Tumbleweed< 1.37.4-2.1
podman&distro=openSUSE Tumbleweed< 5.2.4-2.1

Alpine2 products

buildah< 1.37.5-r0
podman< 5.2.5-r0

Chainguard2 products

buildah< 1.39.0-r2
prometheus-podman-exporter< 1.13.3-r2

Suse2 products

buildah&distro=SUSE Linux Enterprise Module for Containers 15 SP5< 1.35.4-150500.3.16.1
buildah&distro=SUSE Linux Enterprise Module for Containers 15 SP6< 1.35.4-150500.3.16.1

Buildah_project1 product

buildahna

Debian1 product

golang-github-containers-buildahAll versions (No fix recorded) | < 1.37.4+ds1-1

Github.com/containers1 product

buildah< 1.37.1 | < 1.38.0

Ubuntu1 product

golang-github-containers-buildahAll versions (No fix recorded)

Wolfi1 product

buildah< 1.39.0-r2

10 vendors · 95 products

References

54 links

access.redhat.com/errata/RHBA-2024:10967Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2024:8563Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2024:8675Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2024:8679Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2024:8686Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2024:8690Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2024:8700Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2024:8703Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2024:8707Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2024:8708Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory

Show all 54 references

access.redhat.com/errata/RHSA-2024:8709Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2024:8846Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2024:8984Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2024:8994Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2024:9051Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2024:9454Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2024:9459Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2025:2445Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2025:2449Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2025:2454Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2025:2701Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2025:2710Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2025:3301Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHSA-2025:3573Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
access.redhat.com/security/cve/CVE-2024-9675VDB EntryX Refsource REDHATREPORTAdvisoryWEBThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=2317458Issue TrackingX Refsource REDHATREPORTWEB
www.suse.com/support/update/announcement/2024/suse-su-20243728-1/Advisory
bugzilla.suse.com/1231499REPORT
www.suse.com/security/cve/CVE-2024-9675WEB
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8563.jsonAdvisory
www.cve.org/CVERecord?id=CVE-2024-9675AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2024-9675Advisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8675.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8679.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8703.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8707.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8708.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8709.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8994.jsonAdvisory
ubuntu.com/security/CVE-2024-9675REPORT
github.com/advisories/GHSA-586p-749j-fhwpREPORTAdvisory
github.com/containers/buildah/pull/5780REPORT
security-tracker.debian.org/tracker/CVE-2024-9675Advisory
access.redhat.com/downloads/content/package-browser/WEB
catalog.redhat.com/software/containers/WEB
github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9675.jsonAdvisory
github.com/containers/buildahPACKAGE
github.com/containers/buildah/commit/aa67e5d71ee7ec07122a210baa3b13966a9e086cWEBFIX
pkg.go.dev/vuln/GO-2024-3186WEB
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
access.redhat.com/errata/RHEA-2024:6126Vendor AdvisoryX Refsource REDHATWEB
security.alpinelinux.org/vuln/CVE-2024-9675Advisory