CVE-2024-11218: Buildah Containerfile Vulnerability Leading to Build Breakout
Summary
CVE-2024-11218: Buildah allows build breakout using malicious Containerfiles and concurrent builds. Affects github.com/containers/buildah across 4 version ranges.
< 1.33.12
>= 1.35.0, < 1.35.5
>= 1.37.0, < 1.37.6
>= 1.38.0, < 1.38.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- golang-github-containers-buildah · Debian:11
The same CVE-2024-11218 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildah is an open-source tool that facilitates the building of container images. It is designed to create OCI and Docker container images without requiring a daemon. Buildah allows users to define container images using Containerfiles, which can include various instructions for building and configuring the image. However, a vulnerability has been identified that allows malicious Containerfiles to exploit concurrent builds, potentially exposing sensitive data from the host system.
Vulnerability Detail
The vulnerability arises from the misuse of the '--mount' flag in RUN instructions within Containerfiles. When combined with multi-stage builds or concurrent builds, a malicious Containerfile can expose the build host's content to the RUN instruction's command. This can lead to unauthorized access to sensitive files, including setuid executables, especially when the build process is executed with elevated privileges, such as a root-owned podman system service. The implications are severe, as it allows unprivileged users to read and write files they should not have access to.
How To Fix
Latest published version: v1.43.5 as of 22 Oct 2026
go get github.com/containers/buildah@v1.43.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.33.121.33.12go get github.com/containers/buildah@v1.33.12 -
>= 1.35.0, < 1.35.51.35.5go get github.com/containers/buildah@v1.35.5 -
>= 1.37.0, < 1.37.61.37.6go get github.com/containers/buildah@v1.37.6 -
>= 1.38.0, < 1.38.11.38.1go get github.com/containers/buildah@v1.38.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Implement mandatory access controls to limit the access of the process performing the build. This can help mitigate the risk of unauthorized access to sensitive files during the build process.
Conclusion
CVE-2024-11218 presents a significant security risk for users of Buildah, particularly in environments where unprivileged users can execute builds. It is crucial to update to the patched versions and implement access controls to mitigate potential threats.
See every vulnerability recorded for github.com/containers/buildah →
FAQ
CVE-2024-11218 is a vulnerability in Buildah that allows malicious Containerfiles to expose sensitive data from the build host during concurrent builds.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The risks include unauthorized access to sensitive files, including setuid executables, which could be exploited by unprivileged users to gain elevated privileges.
Update Buildah to the latest patched version and implement mandatory access controls to limit the access of the build process.
More information about Buildah can be found on its official GitHub repository and documentation pages.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/buildah.
