CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

CVE-2024-9675: Buildah: buildah allows arbitrary directory mount

Description

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

Classification

CVE ID: CVE-2024-9675

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 12.41% (scored less or equal to compared to others)

EPSS Date: 2025-02-25 (when was this score calculated)

References

Timeline

2025-01-28 00:30:48 UTC
CVE

Buildah: buildah allows arbitrary directory mount
2025-03-11 11:45:22 UTC
Tenable Plugins

RHEL 8 / 9 : OpenShift Container Platform 4.15.38 (RHSA-2024:8994)