Vulnerability Details CVE-2024-9675
A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 19.0%
CVSS Severity
CVSS v3 Score 7.8
References
- https://access.redhat.com/errata/RHSA-2024:8563
- https://access.redhat.com/errata/RHSA-2024:8675
- https://access.redhat.com/errata/RHSA-2024:8679
- https://access.redhat.com/errata/RHSA-2024:8686
- https://access.redhat.com/errata/RHSA-2024:8690
- https://access.redhat.com/errata/RHSA-2024:8700
- https://access.redhat.com/errata/RHSA-2024:8703
- https://access.redhat.com/errata/RHSA-2024:8707
- https://access.redhat.com/errata/RHSA-2024:8708
- https://access.redhat.com/errata/RHSA-2024:8709
- https://access.redhat.com/errata/RHSA-2024:8846
- https://access.redhat.com/errata/RHSA-2024:8984
- https://access.redhat.com/errata/RHSA-2024:8994
- https://access.redhat.com/errata/RHSA-2024:9051
- https://access.redhat.com/errata/RHSA-2024:9454
- https://access.redhat.com/errata/RHSA-2024:9459
- https://access.redhat.com/errata/RHSA-2025:2445
- https://access.redhat.com/errata/RHSA-2025:2449
- https://access.redhat.com/errata/RHSA-2025:2454
- https://access.redhat.com/errata/RHSA-2025:2701
- https://access.redhat.com/errata/RHSA-2025:2710
- https://access.redhat.com/errata/RHSA-2025:3301
- https://access.redhat.com/errata/RHSA-2025:3573
- https://access.redhat.com/security/cve/CVE-2024-9675
- https://bugzilla.redhat.com/show_bug.cgi?id=2317458
Products affected by CVE-2024-9675
-
cpe:2.3:a:buildah_project:buildah:-
-
cpe:2.3:a:redhat:openshift_container_platform:4.13
-
cpe:2.3:a:redhat:openshift_container_platform:4.14
-
cpe:2.3:a:redhat:openshift_container_platform:4.15
-
cpe:2.3:a:redhat:openshift_container_platform:4.16
-
cpe:2.3:a:redhat:openshift_container_platform:4.17
-
cpe:2.3:o:redhat:enterprise_linux:8.0
-
cpe:2.3:o:redhat:enterprise_linux:9.0
-
cpe:2.3:o:redhat:enterprise_linux_eus:8.8
-
cpe:2.3:o:redhat:enterprise_linux_eus:9.0
-
cpe:2.3:o:redhat:enterprise_linux_eus:9.2
-
cpe:2.3:o:redhat:enterprise_linux_eus:9.4
-
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64
-
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64
-
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8_aarch64
-
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.0_aarch64
-
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2_aarch64
-
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.0_s390x
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2_s390x
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.0_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6
-
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2
-
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4
-
Redhat » Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions » Version: 8.6_ppc64lecpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6_ppc64le
-
Redhat » Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions » Version: 8.8_ppc64lecpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.8_ppc64le
-
Redhat » Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions » Version: 9.0_ppc64lecpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.0_ppc64le
-
Redhat » Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions » Version: 9.2_ppc64lecpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le
-
Redhat » Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions » Version: 9.4_ppc64lecpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.4_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6
-
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8
-
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6
-
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8
-
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0
-
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2
-
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4