Path traversal in buildah - CVE-2024-9675

Vulnerability identifier: #VU98828

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-9675

CWE-ID: CWE-22

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to input validation error when processing directory traversal sequences in cache mounts. A local user can execute a 'RUN' instruction in a Container file to mount an arbitrary directory from the host into the container as long as those files can be accessed by the user running Buildah.

buildah
Red Hat OpenShift Container Platform
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Fedora
SUSE Linux Enterprise Server 15 SP4 LTSS
Containers Module
openSUSE Leap
openEuler
Podman
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
toolbox-tests
toolbox
udica
butane (Red Hat package)
containers-common
runc
runc (Red Hat package)
slirp4netns
podman-tui
oci-seccomp-bpf-hook
containernetworking-plugins (Red Hat package)
containernetworking-plugins
aardvark-dns
netavark
skopeo (Red Hat package)
fuse-overlayfs
prometheus-podman-exporter
crun
skopeo-tests
skopeo
cri-tools (Red Hat package)
cri-o (Red Hat package)
buildah (Red Hat package)
buildah-tests
buildah
conmon (Red Hat package)
conmon
haproxy (Red Hat package)
ignition (Red Hat package)
container-selinux
python3-criu
crit
criu
criu-devel
criu-libs
podman (Red Hat package)
libslirp
libslirp-devel
libreswan (Red Hat package)
python3-podman
podman-tests
podman-gvproxy
podman-debugsource
podman-debuginfo
podman
podman-docker
podmansh
podman-help
podman-remote
podman-plugins
podman-catatonit
podman-remote-debuginfo
openshift (Red Hat package)
openshift-ansible (Red Hat package)
openshift-kuryr (Red Hat package)
openshift4-aws-iso (Red Hat package)
openshift-clients (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
cockpit-podman
Multicluster Engine for Kubernetes
OpenShift Data Foundation (formerly OpenShift Container Storage)
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component

Install update from vendor's website.

buildah - addressed in versions 1.29.4, 1.37.5
Podman - update to 5.2.5
toolbox-tests - update to 0.0.99.5-2.0.1
toolbox - update to 0.0.99.5-2.0.1
udica - update to 0.2.6-21
butane (Red Hat package) - update to 0.19.0-4.rhaos4.14.el8
containers-common - update to 0.60.4-4.fc41
runc - update to 1.1.12-5.0.1
runc (Red Hat package) - addressed in versions 1.1.14-2.rhaos4.13.el8, 1.1.14-2.rhaos4.13.el9, 1.1.14-2.rhaos4.14.el8, 1.1.14-2.rhaos4.14.el9
slirp4netns - update to 1.2.3-1
podman-tui - addressed in versions 1.2.3-1.el9, 1.2.3-1.fc40, 1.2.3-1.fc41
oci-seccomp-bpf-hook - update to 1.2.10-1
containernetworking-plugins (Red Hat package) - addressed in versions 1.4.0-4.rhaos4.14.el8, 1.4.0-5.rhaos4.13.el8
containernetworking-plugins - update to 1.4.0-5.0.1
aardvark-dns - update to 1.10.1-2.0.1
netavark - update to 1.10.3-1.0.1
skopeo (Red Hat package) - addressed in versions 1.11.3-4.rhaos4.13.el8, 1.11.3-4.rhaos4.13.el9, 1.11.3-4.rhaos4.14.el8, 1.11.3-4.rhaos4.14.el9
fuse-overlayfs - update to 1.13-1.0.1
prometheus-podman-exporter - addressed in versions 1.13.3-1.el9, 1.13.3-1.fc39, 1.13.3-1.fc40, 1.13.3-1.fc41
crun - update to 1.14.3-2
skopeo-tests - update to 1.14.5-3.0.1
skopeo - update to 1.14.5-3.0.1
cri-tools (Red Hat package) - addressed in versions 1.26.0-7.el8, 1.26.0-7.el9, 1.27.0-6.el8, 1.27.0-6.el9
cri-o (Red Hat package) - addressed in versions 1.26.5-26.rhaos4.13.giteb3d487.el8, 1.26.5-26.rhaos4.13.giteb3d487.el9, 1.27.8-12.rhaos4.14.git7597c43.el8, 1.27.8-12.rhaos4.14.git7597c43.el9, 1.30.7-2.rhaos4.17.git2391edc.el8, 1.30.7-2.rhaos4.17.git2391edc.el9
buildah (Red Hat package) - addressed in versions 1.26.8-2.el9_0, 1.29.1-5.rhaos4.13.el9, 1.29.1-13.rhaos4.14.el8, 1.29.1-13.rhaos4.14.el9, 1.29.4-1.el9_2, 1.33.10-1.el9_4, 1.37.5-1.el9_5
buildah-tests - update to 1.33.10-1
buildah - update to 1.33.10-1
buildah - addressed in versions 1.35.4-150300.8.28.3, 1.35.4-150400.3.33.1, 1.35.4-150500.3.16.1
buildah - addressed in versions 1.37.5-1.fc40, 1.37.5-1.fc41
containers-common - update to 1-82.0.1
conmon (Red Hat package) - addressed in versions 2.1.7-5.rhaos4.13.el8, 2.1.7-5.rhaos4.13.el9, 2.1.7-6.rhaos4.14.el8, 2.1.7-6.rhaos4.14.el9
conmon - update to 2.1.10-1
haproxy (Red Hat package) - update to 2.2.24-5.rhaos4.13.el8
Multicluster Engine for Kubernetes - addressed in versions 2.3.8, 2.6.4
ignition (Red Hat package) - addressed in versions 2.15.0-10.rhaos4.13.el9, 2.16.2-5.rhaos4.14.el9
container-selinux - update to 2.229.0-2
python3-criu - update to 3.18-5.0.1
crit - update to 3.18-5.0.1
criu - update to 3.18-5.0.1
criu-devel - update to 3.18-5.0.1
criu-libs - update to 3.18-5.0.1
podman (Red Hat package) - addressed in versions 4.2.0-5.el9_0.2, 4.4.1-15.rhaos4.13.el8, 4.4.1-16.rhaos4.13.el9, 4.4.1-21.el9_2, 4.4.1-21.rhaos4.14.el8, 4.4.1-21.rhaos4.14.el9, 4.4.1-32.rhaos4.15.el8, 4.4.1-32.rhaos4.15.el9, 4.9.4-12.rhaos4.16.el8, 4.9.4-14.rhaos4.16.el9, 4.9.4-16.el9_4, 5.2.2-1.rhaos4.17.el8, 5.2.2-1.rhaos4.17.el9, 5.2.2-9.el9_5
libslirp - update to 4.4.0-2
libslirp-devel - update to 4.4.0-2
libreswan (Red Hat package) - update to 4.5-1.el9
python3-podman - update to 4.9.0-2
podman-tests - update to 4.9.4-13
podman-gvproxy - update to 4.9.4-13
podman-debugsource - update to 4.9.4-13
podman-debuginfo - update to 4.9.4-13
podman - update to 4.9.4-13
podman-docker - update to 4.9.4-13
podmansh - update to 4.9.4-13
podman-help - update to 4.9.4-13
podman-remote - update to 4.9.4-13
podman-plugins - update to 4.9.4-13
podman-docker - update to 4.9.4-15.0.1
podman-tests - update to 4.9.4-15.0.1
podman-remote - update to 4.9.4-15.0.1
podman-plugins - update to 4.9.4-15.0.1
podman - update to 4.9.4-15.0.1
podman-catatonit - update to 4.9.4-15.0.1
podman-gvproxy - update to 4.9.4-15.0.1
podman-remote-debuginfo - addressed in versions 4.9.5-150300.9.43.1, 4.9.5-150400.4.35.1, 4.9.5-150500.3.25.1
podmansh - addressed in versions 4.9.5-150300.9.43.1, 4.9.5-150400.4.35.1, 4.9.5-150500.3.25.1
podman-remote - addressed in versions 4.9.5-150300.9.43.1, 4.9.5-150400.4.35.1, 4.9.5-150500.3.25.1
podman - addressed in versions 4.9.5-150300.9.43.1, 4.9.5-150400.4.35.1, 4.9.5-150500.3.25.1
podman-debuginfo - addressed in versions 4.9.5-150300.9.43.1, 4.9.5-150400.4.35.1, 4.9.5-150500.3.25.1
podman-docker - addressed in versions 4.9.5-150300.9.43.1, 4.9.5-150400.4.35.1, 4.9.5-150500.3.25.1
Red Hat OpenShift Container Platform - addressed in versions 4.12.75, 4.13.53, 4.14.40, 4.15.38, 4.15.39, 4.15.47, 4.16.20, 4.16.23, 4.16.24, 4.16.38, 4.17.4, 4.17.20, 4.18.4
openshift (Red Hat package) - addressed in versions 4.13.0-202410181847.p0.g53fd427.assembly.stream.el8, 4.13.0-202410181847.p0.g53fd427.assembly.stream.el9, 4.14.0-202410181711.p0.g03a907c.assembly.stream.el8, 4.14.0-202410181711.p0.g03a907c.assembly.stream.el9, 4.16.0-202410231936.p0.g5865c5b.assembly.stream.el8, 4.16.0-202410231936.p0.g5865c5b.assembly.stream.el9
openshift-ansible (Red Hat package) - addressed in versions 4.13.0-202410181847.p0.g1397e80.assembly.stream.el8, 4.13.0-202410181847.p0.g1397e80.assembly.stream.el9, 4.14.0-202410181711.p0.g846e89b.assembly.stream.el8, 4.14.0-202410181711.p0.g846e89b.assembly.stream.el9
openshift-kuryr (Red Hat package) - addressed in versions 4.13.0-202410181847.p0.g36754b7.assembly.stream.el8, 4.14.0-202410181711.p0.g8926a29.assembly.stream.el8
openshift4-aws-iso (Red Hat package) - addressed in versions 4.13.0-202410181847.p0.gd2acdd5.assembly.stream.el8, 4.14.0-202410181711.p0.gd2acdd5.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.13.0-202410181847.p0.gd192e90.assembly.stream.el8, 4.13.0-202410181847.p0.gd192e90.assembly.stream.el9, 4.14.0-202410181711.p0.g44b3ac2.assembly.stream.el8, 4.14.0-202410181711.p0.g44b3ac2.assembly.stream.el9, 4.17.0-202410231505.p0.gdde885f.assembly.stream.el8, 4.17.0-202410231505.p0.gdde885f.assembly.stream.el9
ose-aws-ecr-image-credential-provider (Red Hat package) - addressed in versions 4.14.0-202410181711.p0.g9a7820e.assembly.stream.el8, 4.14.0-202410181711.p0.g9a7820e.assembly.stream.el9
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.14.13, 4.15.9, 4.16.4, 4.17.1
watsonx Assistant Cartridge - update to 5.1.1
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.1
podman - addressed in versions 5.2.5-1.fc40, 5.2.5-1.fc41
kernel (Red Hat package) - addressed in versions 5.14.0-284.92.1.el9_2, 5.14.0-427.44.1.el9_4
kernel-rt (Red Hat package) - update to 5.14.0-284.92.1.rt14.377.el9_2
cockpit-podman - update to 84.1-1

• https://bugzilla.redhat.com/show_bug.cgi?id=2317458
• https://github.com/containers/buildah/releases/tag/v1.37.5

• Privilege escalation in Buildah
• Privilege escalation in Podman
• SUSE update for buildah
• Fedora 41 update for buildah, containers-common, podman
• Fedora 40 update for podman-tui
• Fedora 41 update for podman-tui
• Fedora EPEL 9 update for podman-tui
• Fedora 41 update for prometheus-podman-exporter
• Fedora 39 update for prometheus-podman-exporter
• Fedora 40 update for prometheus-podman-exporter
• Fedora EPEL 9 update for prometheus-podman-exporter
• SUSE update for podman
• Fedora 40 update for buildah, podman
• Red Hat Enterprise Linux 9 update for buildah
• Red Hat Enterprise Linux 9 update for buildah
• Red Hat Enterprise Linux 9 update for podman
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Red Hat Enterprise Linux 9 update for buildah
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Red Hat Enterprise Linux 9 update for podman
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14 packages
• Red Hat Enterprise Linux 9 update for podman
• Red Hat Enterprise Linux 9 update for podman
• Red Hat Enterprise Linux 9 update for buildah
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Path traversal in Red Hat OpenShift Container Platform 4.15 packages
• SUSE update for buildah
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.3
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.17
• SUSE update for buildah
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.16
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.6
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.15
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.14
• openEuler 24.03 LTS SP1 update for podman
• openEuler 24.03 LTS update for podman
• SUSE update for podman
• SUSE update for podman
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component update for Buildah
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• Anolis OS update for container-tools:an8 module
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12 packages