CVE-2024-9407: Improper Input Validation in Buildah and Podman
Summary
CVE-2024-9407: Improper Input Validation in Buildah and Podman. Affects github.com/containers/buildah versions < 1.37.4. Fixed in 1.37.4. How to fix ↓
Also tracked for
- golang-github-containers-buildah · Debian:11
The same CVE-2024-9407 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildah and Podman are open-source tools designed for building and managing container images and containers. They provide users with the ability to create, manage, and run containers without the need for a full-fledged container runtime. These tools are widely used in cloud-native environments and DevOps workflows due to their lightweight nature and flexibility. However, the improper input validation vulnerability in the bind-propagation option of the Dockerfile RUN --mount instruction poses a significant risk, allowing unauthorized access to sensitive host directories.
Vulnerability Detail
A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system fails to properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This can be exploited to mount sensitive directories from the host into a container during the build process, potentially modifying the contents of those mounted files. Even with SELinux in place, this vulnerability can bypass its protections by allowing the source directory to be relabeled, granting the container access to host files. The CVSS score for this vulnerability is 4.7, indicating a moderate severity level.
How To Fix
Latest published version: v1.43.5 as of 22 Oct 2026
go get github.com/containers/buildah@v1.43.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.37.4
This is the first release that contains the fix.
go get github.com/containers/buildah@v1.37.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the bind-propagation option in the Dockerfile RUN --mount instruction until the vulnerability is patched. This will help mitigate the risk of exposing sensitive host directories to containers during the build process.
Conclusion
The improper input validation vulnerability in Buildah and Podman (CVE-2024-9407) poses a significant risk to users by allowing unauthorized access to sensitive host directories. It is crucial to update to the latest versions of these tools to mitigate this risk. Additionally, users can utilize Vulert to monitor their applications for vulnerabilities effectively.
See every vulnerability recorded for github.com/containers/buildah →
FAQ
CVE-2024-9407 is a vulnerability in Buildah and Podman that allows improper input validation in the bind-propagation option of the Dockerfile RUN --mount instruction.
An attacker can exploit this vulnerability by passing arbitrary parameters to the mount instruction, allowing them to mount sensitive directories from the host into a container.
The consequences include unauthorized access to sensitive host files and the ability to modify their contents, which can lead to data breaches or system compromise.
No, this vulnerability can bypass SELinux protections by allowing the source directory to be relabeled, granting the container access to host files.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/buildah.
