Improper Privilege Management in buildah - CVE-2024-1753

Vulnerability identifier: #VU87616

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-1753

CWE-ID: CWE-269

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to the affected application allows containers to mount arbitrary locations on the host filesystem into build containers. A remote attacker can escalate privileges.

buildah
Red Hat OpenShift Container Platform
Gentoo Linux
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
Public Cloud Module
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Containers Module
openSUSE Leap
openEuler
Fedora
Podman
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
toolbox-tests
toolbox
udica
cni
cni-plugins
aardvark-dns
netavark
containernetworking-plugins
slirp4netns
runc
runc (Red Hat package)
oci-seccomp-bpf-hook
containernetworking-plugins (Red Hat package)
skopeo-tests
skopeo
crun
fuse-overlayfs
skopeo (Red Hat package)
buildah-tests
buildah
cri-tools (Red Hat package)
buildah-debuginfo
buildah-debugsource
cri-o (Red Hat package)
buildah (Red Hat package)
app-containers/buildah
containers-common
conmon
conmon (Red Hat package)
ignition (Red Hat package)
container-selinux
criu-devel
python3-criu
criu-libs
crit
criu
python3-podman
podman-gvproxy
podman-docker
podman-tests
podman-catatonit
podman-remote
podman
podman-plugins
podman (Red Hat package)
libslirp-devel
libslirp
podman-cni-config
podman-remote-debuginfo
podman-debuginfo
podmansh
app-containers/podman
openshift-ansible (Red Hat package)
openshift-kuryr (Red Hat package)
openshift4-aws-iso (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
ovn23.06 (Red Hat package)
docker
docker-debuginfo
docker-rootless-extras
docker-zsh-completion
docker-bash-completion
docker-fish-completion
cockpit-podman
Ansible Automation Platform
PowerStore T

Install updates from vendor's website.

buildah - addressed in versions 1.24.7, 1.26.7, 1.34.2, 1.35.1, 1.27.4, 1.29.3, 1.32.3, 1.33.8
Podman - addressed in versions 4.9.4, 5.0.1
toolbox-tests - addressed in versions 0.0.99.4-5.0.1, 0.0.99.5-2.0.1
toolbox - addressed in versions 0.0.99.4-5.0.1, 0.0.99.5-2.0.1
udica - addressed in versions 0.2.6-4, 0.2.6-21
cni - update to 0.7.1-150100.3.18.1
cni-plugins - update to 0.8.6-150100.3.22.3
aardvark-dns - addressed in versions 1.0.1-38, 1.10.0-2.0.1
netavark - addressed in versions 1.0.1-38, 1.10.3-1.0.1
containernetworking-plugins - addressed in versions 1.1.1-6.0.1, 1.4.0-2.0.1
slirp4netns - addressed in versions 1.1.8-3.0.1, 1.2.3-1
runc - update to 1.1.12-1.0.1
runc (Red Hat package) - update to 1.1.12-1.2.rhaos4.13.el8
oci-seccomp-bpf-hook - addressed in versions 1.2.5-2.0.1, 1.2.10-1
containernetworking-plugins (Red Hat package) - update to 1.4.0-1.2.rhaos4.13.el8
skopeo-tests - addressed in versions 1.6.2-9.0.1, 1.14.3-2.0.1
skopeo - addressed in versions 1.6.2-9.0.1, 1.14.3-2.0.1
crun - addressed in versions 1.8.7-1.0.1, 1.14.3-2
fuse-overlayfs - addressed in versions 1.9-2, 1.13-1.0.1
skopeo (Red Hat package) - addressed in versions 1.11.3-0.2.rhaos4.13.el8, 1.11.3-0.2.rhaos4.13.el9
buildah-tests - addressed in versions 1.24.7-1.0.1, 1.33.7-1
buildah - addressed in versions 1.24.7-1.0.1, 1.33.7-1
buildah - addressed in versions 1.25.1-150100.3.23.1, 1.34.1-150300.8.22.1, 1.34.1-150400.3.27.1, 1.34.1-150500.3.7.1, 1.35.4-150300.8.25.1, 1.35.4-150400.3.30.1, 1.35.4-150500.3.10.1
cri-tools (Red Hat package) - addressed in versions 1.26.0-4.2.el8, 1.26.0-4.3.el9
buildah - update to 1.26.1-4
buildah-debuginfo - update to 1.26.1-4
buildah-debugsource - update to 1.26.1-4
cri-o (Red Hat package) - addressed in versions 1.26.5-11.2.rhaos4.13.git919cc6e.el8, 1.26.5-11.2.rhaos4.13.git919cc6e.el9, 1.26.5-15.2.rhaos4.13.gitb742e63.el8, 1.26.5-15.2.rhaos4.13.gitb742e63.el9, 1.27.6-2.rhaos4.14.gitb3bd0bf.el8, 1.27.6-2.rhaos4.14.gitb3bd0bf.el9
buildah (Red Hat package) - addressed in versions 1.26.7-1.el9_0, 1.29.1-2.3.rhaos4.13.el8, 1.29.3-1.el9_2, 1.31.5-1.el9_3
app-containers/buildah - update to 1.35.3
containers-common - addressed in versions 1-38, 1-81.0.1
conmon - addressed in versions 2.1.4-2.0.1, 2.1.10-1
conmon (Red Hat package) - addressed in versions 2.1.7-2.3.rhaos4.13.el8, 2.1.7-2.3.rhaos4.13.el9
Ansible Automation Platform - update to 2.4
ignition (Red Hat package) - update to 2.15.0-7.2.rhaos4.13.el9
container-selinux - addressed in versions 2.205.0-3, 2.229.0-2
PowerStore T - update to 3.6.1.4-2413340
criu-devel - addressed in versions 3.15-3, 3.18-5.0.1
python3-criu - addressed in versions 3.15-3, 3.18-5.0.1
criu-libs - addressed in versions 3.15-3, 3.18-5.0.1
crit - addressed in versions 3.15-3, 3.18-5.0.1
criu - addressed in versions 3.15-3, 3.18-5.0.1
python3-podman - addressed in versions 4.0.0-2, 4.9.0-1
podman-gvproxy - addressed in versions 4.0.2-26.0.1, 4.9.4-1.0.1
podman-docker - addressed in versions 4.0.2-26.0.1, 4.9.4-1.0.1
podman-tests - addressed in versions 4.0.2-26.0.1, 4.9.4-1.0.1
podman-catatonit - addressed in versions 4.0.2-26.0.1, 4.9.4-1.0.1
podman-remote - addressed in versions 4.0.2-26.0.1, 4.9.4-1.0.1
podman - addressed in versions 4.0.2-26.0.1, 4.9.4-1.0.1
podman-plugins - addressed in versions 4.0.2-26.0.1, 4.9.4-1.0.1
podman (Red Hat package) - addressed in versions 4.2.0-3.el9_0, 4.4.1-5.3.rhaos4.13.el8, 4.4.1-6.3.rhaos4.13.el9, 4.4.1-7.3.rhaos4.13.el8, 4.4.1-8.3.rhaos4.13.el9, 4.4.1-13.4.rhaos4.14.el8, 4.4.1-13.4.rhaos4.14.el9, 4.4.1-16.el9_2, 4.9.4-3.el9_4
libslirp-devel - addressed in versions 4.4.0-1, 4.4.0-2
libslirp - addressed in versions 4.4.0-1, 4.4.0-2
podman-remote - addressed in versions 4.4.4-150300.9.26.2, 4.4.4-150400.4.22.1, 4.8.3-150500.3.9.1, 4.9.5-150300.9.43.1, 4.9.5-150400.4.35.1
podman-docker - addressed in versions 4.4.4-150300.9.26.2, 4.4.4-150400.4.22.1, 4.8.3-150500.3.9.1, 4.9.5-150300.9.43.1, 4.9.5-150400.4.35.1
podman-cni-config - addressed in versions 4.4.4-150300.9.26.2, 4.4.4-150400.4.22.1
podman-remote-debuginfo - addressed in versions 4.4.4-150300.9.26.2, 4.4.4-150400.4.22.1, 4.8.3-150500.3.9.1, 4.9.5-150300.9.43.1, 4.9.5-150400.4.35.1
podman-debuginfo - addressed in versions 4.4.4-150300.9.26.2, 4.4.4-150400.4.22.1, 4.8.3-150500.3.9.1, 4.9.5-150300.9.43.1, 4.9.5-150400.4.35.1
podman - addressed in versions 4.4.4-150300.9.26.2, 4.4.4-150400.4.22.1, 4.8.3-150500.3.9.1, 4.9.5-150300.9.43.1, 4.9.5-150400.4.35.1
podmansh - addressed in versions 4.8.3-150500.3.9.1, 4.9.5-150300.9.43.1, 4.9.5-150400.4.35.1
app-containers/podman - update to 4.9.4
podman - addressed in versions 4.9.4-1.fc38, 4.9.4-1.fc39, 5.0.0-1.fc40
Red Hat OpenShift Container Platform - addressed in versions 4.12.57, 4.15.12, 4.15.15
openshift-ansible (Red Hat package) - addressed in versions 4.13.0-202404151710.p0.g2d540c5.assembly.stream.el8, 4.13.0-202404151710.p0.g2d540c5.assembly.stream.el9
openshift-kuryr (Red Hat package) - update to 4.13.0-202404151710.p0.g36754b7.assembly.stream.el8
openshift4-aws-iso (Red Hat package) - update to 4.13.0-202404151710.p0.gd2acdd5.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.13.0-202404151710.p0.gd192e90.assembly.stream.el8, 4.13.0-202404151710.p0.gd192e90.assembly.stream.el9
openshift (Red Hat package) - addressed in versions 4.13.0-202404222036.p0.g4818370.assembly.stream.el8, 4.13.0-202404222036.p0.g4818370.assembly.stream.el9, 4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el8, 4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el9
kernel (Red Hat package) - update to 5.14.0-284.64.1.el9_2
kernel-rt (Red Hat package) - update to 5.14.0-284.64.1.rt14.349.el9_2
ovn23.06 (Red Hat package) - update to 23.06.3-29.el9fdp
docker - update to 25.0.6_ce-150000.207.1
docker-debuginfo - update to 25.0.6_ce-150000.207.1
docker-rootless-extras - update to 25.0.6_ce-150000.207.1
docker-zsh-completion - update to 25.0.6_ce-150000.207.1
docker-bash-completion - update to 25.0.6_ce-150000.207.1
docker-fish-completion - update to 25.0.6_ce-150000.207.1
cockpit-podman - addressed in versions 46-1, 84.1-1

• https://access.redhat.com/security/cve/CVE-2024-1753
• https://bugzilla.redhat.com/show_bug.cgi?id=2265513
• https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf
• https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3
• https://github.com/containers/buildah/releases/tag/v1.34.2
• https://github.com/containers/buildah/releases/tag/v1.24.7
• https://github.com/containers/buildah/releases/tag/v1.26.7

• Improper Privilege Management in buildah
• Fedora 40 update for podman
• Improper Privilege Management in Podman
• Fedora 38 update for podman
• Fedora 39 update for podman
• Multiple vulnerabilities in buildah
• SUSE update for podman
• SUSE update for podman
• SUSE update for buildah
• SUSE update for buildah
• SUSE update for buildah
• SUSE update for buildah
• SUSE update for podman
• Red Hat Enterprise Linux 9 update for buildah
• Red Hat Enterprise Linux 9.2 Extended Update Support update for buildah
• Red Hat Enterprise Linux 9.0 Extended Update Support update for buildah
• Red Hat Enterprise Linux 9.0 Extended Update Support update for podman
• Red Hat Enterprise Linux 8.8 Extended Update Support update for the container-tools:rhel8 module
• Red Hat Enterprise Linux 8 update for the container-tools:4.0 module
• Red Hat Enterprise Linux 8.6 Extended Update Support update for the container-tools:4.0 module
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Red Hat Enterprise Linux 8.6 Extended Update Support update for the container-tools:rhel8 module
• Red Hat Enterprise Linux 9 update for podman
• Red Hat Enterprise Linux 9.2 Extended Update Support update for podman
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13 packages
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Gentoo update for podman
• Gentoo update for Buildah
• SUSE update for buildah, docker
• SUSE update for buildah
• SUSE update for buildah
• Multiple vulnerabilities in Containers Buildah
• Multiple vulnerabilities in Dell PowerStore T
• openEuler 22.03 LTS SP4 update for buildah
• SUSE update for podman
• SUSE update for podman
• Anolis OS update for container-tools:4.0 module
• Anolis OS update for container-tools:an8 module